Overview

overview

10

Static

static

10

b569097168...8b.exe

windows7-x64

10

b569097168...8b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5690971684484c0c1f3b29f428e631ac18af0b8bf636ea0230a1b7fd082418b

  • Size

    1.6MB

  • MD5

    1250f8db37edf8344bf2d4b85998b319

  • SHA1

    3be39f97dafc08a07805529a7e7986afd9903cf1

  • SHA256

    b5690971684484c0c1f3b29f428e631ac18af0b8bf636ea0230a1b7fd082418b

  • SHA512

    87cd2478e86d91b640b5265c98b1e7499378768e8c255679b57f34eb2f08525e8435d92b304011ed26a38799739f4eb355bf514b1982dc14dbd5900a0b4dc741

  • SSDEEP

    49152:eLTq24GjdGSiqkqXfd+/9AqYanieKdQH:eiEjdGSiqkqXf0FLYW

Score
10/10
stealerium

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1236288178802135147/P2iZLzB_oNJFDenlHnHhz96DQUs2xxEf_VjLdUsuQkmmrMTuE9UJ6YfWkmHmfxN_m61i

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects executables manipulated with Fody 1 IoCs
  • Detects executables referencing Discord tokens regular expressions 1 IoCs
  • Detects executables referencing credit card regular expressions 1 IoCs
  • Detects executables referencing many VPN software clients. Observed in infosteslers 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
  • Detects executables with interest in wireless interface using netsh 1 IoCs
  • Stealerium family
    stealerium
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b5690971684484c0c1f3b29f428e631ac18af0b8bf636ea0230a1b7fd082418b
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections