Overview

overview

10

Static

static

10

ImageLogger.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ImageLogger.exe

  • Size

    1.6MB

  • Sample

    240603-tdlx2abe8t

  • MD5

    a74b4cfc22ffd4bb7b5b1d7e78dbaf20

  • SHA1

    8c7b2138ecc8e25080bb961a823ea4e56af7ddc1

  • SHA256

    7d2cb2c6ad3552f676d456c40e8194751d0f3aea050a2d2d5d2945bc46264aa8

  • SHA512

    a998195e8571a509b8a44932315d47f132f22cef55a383e9e9e58f04b3daba11fa1f0345a178a9cb345a3c0a53bf30670254445077d8429e849846840db036be

  • SSDEEP

    49152:skTq24GjdGSiqkqXfd+/9AqYanieKdsF:s1EjdGSiqkqXf0FLYW

Score
10/10
stealeriumcollectionspywarestealer

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1247157128620146719/THCypGz_J9AtEKD7GlhD2wv9uBIIsY6__2CtptDrxBzuFNG5kepNU49sn5NF24F3gpQT

Targets

    • Target

      ImageLogger.exe

    • Size

      1.6MB

    • MD5

      a74b4cfc22ffd4bb7b5b1d7e78dbaf20

    • SHA1

      8c7b2138ecc8e25080bb961a823ea4e56af7ddc1

    • SHA256

      7d2cb2c6ad3552f676d456c40e8194751d0f3aea050a2d2d5d2945bc46264aa8

    • SHA512

      a998195e8571a509b8a44932315d47f132f22cef55a383e9e9e58f04b3daba11fa1f0345a178a9cb345a3c0a53bf30670254445077d8429e849846840db036be

    • SSDEEP

      49152:skTq24GjdGSiqkqXfd+/9AqYanieKdsF:s1EjdGSiqkqXf0FLYW

    Score
    10/10
    stealeriumcollectionspywarestealer

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

      stealerstealerium

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks