General

  • Target

    Emma V6.exe

  • Size

    1.6MB

  • Sample

    240823-2w85aatfmk

  • MD5

    aac115654fd637376a96b46794d8ab99

  • SHA1

    5fa30297afe8d3502d807f510e80c7e62a2a9e88

  • SHA256

    a8358fe9d6c84b8b06d69ca00b8236e2ad8fdf88f6d3f2e2386abf27a631c4ad

  • SHA512

    9c5df76d2c01e8639e2e97f99c3418fd31762abebac34c3350442adcac50456e5d3592b847169cec1f6780b8ecbbb5e10841cb4f80a54d63b3b462e865f8ce67

  • SSDEEP

    49152:OkTq24GjdGSiqkqXfd+/9AqYanieKdsG:O1EjdGSiqkqXf0FLYW

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1276642384742055958/0YZ5JihKBfwTtzcx6Lgs0EI5SIICKZ3ztFdmF_91_lRqaZuP94tH8Uc7mr9L0txksi-l

Targets

    • Target

      Emma V6.exe

    • Size

      1.6MB

    • MD5

      aac115654fd637376a96b46794d8ab99

    • SHA1

      5fa30297afe8d3502d807f510e80c7e62a2a9e88

    • SHA256

      a8358fe9d6c84b8b06d69ca00b8236e2ad8fdf88f6d3f2e2386abf27a631c4ad

    • SHA512

      9c5df76d2c01e8639e2e97f99c3418fd31762abebac34c3350442adcac50456e5d3592b847169cec1f6780b8ecbbb5e10841cb4f80a54d63b3b462e865f8ce67

    • SSDEEP

      49152:OkTq24GjdGSiqkqXfd+/9AqYanieKdsG:O1EjdGSiqkqXf0FLYW

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks