General

  • Target

    BetterDiscordInstall.exe

  • Size

    1.6MB

  • Sample

    240831-lv61jaxfpq

  • MD5

    8a8983e0baede23bb69aff5898d318bb

  • SHA1

    afda3bfd734661d51b11cbeae238497cc2cc3b33

  • SHA256

    0c8f75a2a09892add050b6f0b035fd1f61aec6ce71164f2d70753070b4fc8c83

  • SHA512

    e15b6a8f414ed161e6537897da7db978e71299c6cf2e8dac88e5d07b7d28771fb0e7e64824522898369c725bd3a21079db5411f445fa5ce170c676e3f7ac38f2

  • SSDEEP

    49152:rkTq24GjdGSiqkqXfd+/9AqYanieKdsf:r1EjdGSiqkqXf0FLYW

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1277005579193417801/a63yhKDEwrmmx4tQQwJt77b_XVM2eVLEYxj2VfNW2I8UbUt0YKPcuhMPqR7sWCGQYWHw

Targets

    • Target

      BetterDiscordInstall.exe

    • Size

      1.6MB

    • MD5

      8a8983e0baede23bb69aff5898d318bb

    • SHA1

      afda3bfd734661d51b11cbeae238497cc2cc3b33

    • SHA256

      0c8f75a2a09892add050b6f0b035fd1f61aec6ce71164f2d70753070b4fc8c83

    • SHA512

      e15b6a8f414ed161e6537897da7db978e71299c6cf2e8dac88e5d07b7d28771fb0e7e64824522898369c725bd3a21079db5411f445fa5ce170c676e3f7ac38f2

    • SSDEEP

      49152:rkTq24GjdGSiqkqXfd+/9AqYanieKdsf:r1EjdGSiqkqXf0FLYW

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks