Extracted

• • Target

    b5690971684484c0c1f3b29f428e631ac18af0b8bf636ea0230a1b7fd082418b

  • Size

    1.6MB

  • MD5

    1250f8db37edf8344bf2d4b85998b319

  • SHA1

    3be39f97dafc08a07805529a7e7986afd9903cf1

  • SHA256

    b5690971684484c0c1f3b29f428e631ac18af0b8bf636ea0230a1b7fd082418b

  • SHA512

    87cd2478e86d91b640b5265c98b1e7499378768e8c255679b57f34eb2f08525e8435d92b304011ed26a38799739f4eb355bf514b1982dc14dbd5900a0b4dc741

  • SSDEEP

    49152:eLTq24GjdGSiqkqXfd+/9AqYanieKdQH:eiEjdGSiqkqXf0FLYW

  Score

  10^/10

  stealeriumstealer

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects executables manipulated with Fody

  • Detects executables referencing Discord tokens regular expressions

  • Detects executables referencing credit card regular expressions

  • Detects executables referencing many VPN software clients. Observed in infosteslers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

  • Detects executables referencing many email and collaboration clients. Observed in information stealers

  • Detects executables with interest in wireless interface using netsh

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2