Extracted

• • Target

    Message_20240703082651_snippa/Message_20240703082651_snippa.wav.exe

  • Size

    2.2MB

  • MD5

    b862a2b99c3968173b3de780bd696027

  • SHA1

    7531769525187639f1530b42f221ad1a9b189a8f

  • SHA256

    e600f4c6b7476c6a87f2cb342b46e0e7b96790c2b25448af030e866b71f2b4b6

  • SHA512

    9bec24ed3dfdb71c8433a8fb2923423c543554e484b77c7a15c344e66d2c840188e0e4f87582a32a00580df4e5cb89d62b54892d3f9b19a671bde668fff5fb8e

  • SSDEEP

    49152:cJuGb6/6D58MO8qA3hRg+Egv9LPb0S7CmeULsPy8x11eIwhmX6c:cJJW/6W8hheEvRPPP3cy6woX6

  Score

  10^/10

  stealeriumcollectionpersistenceprivilege_escalationspywarestealer

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2