Extracted

• • Target

    build.exe

  • Size

    1.6MB

  • MD5

    ddc61a6501b0b39fe5eeb1ec81b022b8

  • SHA1

    4a139f3a638a398812b99797c527cc62c37b6462

  • SHA256

    7c9347b21eb3fde58070c1326ca7f6c9239dc2f0969b413ae4c6539b8f306f43

  • SHA512

    d49c7419009e21e7622cc13708d48a8257c5cc525743aecaea020b604db27702d9c5a868028c555d458b96051a44aec1635005fab8e3371580cd47ad14d5fd4e

  • SSDEEP

    49152:7kTq24GjdGSiqkqXfd+/9AqYanieKdsH:71EjdGSiqkqXf0FLYW

  Score

  10^/10

  stealeriumcollectioncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1

• • Target

    stub.exe

  • Size

    1.6MB

  • MD5

    6627adf7167ee571e8fd6c8b1a0e8ae3

  • SHA1

    03b9112660ee73c59d84e219f15bf24ae9df48db

  • SHA256

    6c5935bcddaa1d4f809487f66db758e892cc0a7fd7704d138904bc879644ea1f

  • SHA512

    e05896a6e0d09d4dafeb2467395ca06ae1e728a4aa079041dea82940caeb71646984604fdeea482748423b10257b8462db4f573682f9f719939143fdb5691c60

  • SSDEEP

    49152:19Tq24GjdGSiqkqXfd+/9AqYanieKd0U:1YEjdGSiqkqXf0FLYW

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral2