stealerium | Bootstrapper[.]rar

General

Target
Bootstrapper.rar
Size 1.5MB
Sample240811-blk2lascke
SHA256 19c1b5795f8f1675c94119ba7d5c7f911a43b7164354f39e61923dc745be3770
MD5 15cb9de6f54ee905a6b70716568de921
SHA1 3a2675b000fc47f0a6871519a87aa5284764571c
SHA512 6cc704728f6ecae06ff83e95154c93d3458f9ec1c9c02e2bb8e06a2b096d3d5545ba61db08f8d0a3abc94f3d732b52bef98b04d15e18d6b33d65a932f66e12ce
SSDEEP 24576:nki5ydpN5C6DrmCB0UWyK19pvUUGU+B8mrqJDMtJWLDA8DqYinbJzOmT9F5Y:n35ydn5CTgMcL9BdmxQJQD1Gxbp3Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1271994620506804254/vYmBnPlhAIXoPt3lQIQeNKqDPEYR_BAjqEzTMLWpWFVn3_-wv-Mbnuplo9o-ZbRTgB3T

Signatures

Stealerium family
stealerium

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Bootstrapper.exe

File Explorer

Bootstrapper.rar

.rar 1.5MB
Bootstrapper.exe

.exe 1.6MB

Bootstrapper.rar

SHA256 19c1b5795f8f1675c94119ba7d5c7f911a43b7164354f39e61923dc745be3770
MD5 15cb9de6f54ee905a6b70716568de921
SHA1 3a2675b000fc47f0a6871519a87aa5284764571c
SHA512 6cc704728f6ecae06ff83e95154c93d3458f9ec1c9c02e2bb8e06a2b096d3d5545ba61db08f8d0a3abc94f3d732b52bef98b04d15e18d6b33d65a932f66e12ce
SSDEEP 24576:nki5ydpN5C6DrmCB0UWyK19pvUUGU+B8mrqJDMtJWLDA8DqYinbJzOmT9F5Y:n35ydn5CTgMcL9BdmxQJQD1Gxbp3Y
MD5 SHA1 SHA512 SSDEEP

Bootstrapper.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d762a5e5b2dfada4da317663a099935db399aff891ffeaa564e13d731851d330
MD5 9853ccf67f0c8a8733b42ea9752d7a08
SHA1 72911acd31e0931ad49672c27ed48a67153d470f
SHA512 60cd3dfe3a0bb438effb1d9ed2c471eac7553e47daf115e8aeb9bb3d92f589eab82ae5ea4965c84ce17b7f53a5b6af0b8939f5dc7e49ba0bdee66f7ff4b113d1
SSDEEP 49152:EcTq24GjdGSiqkqXfd+/9AqYanieKdYc:E9EjdGSiqkqXf0FLYW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1630510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Bootstrapper.rar

Bootstrapper.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Bootstrapper.rar

Bootstrapper.exe

mscoree

dotnet