General

  • Target

    USBDeviceDriver.exe

  • Size

    1.6MB

  • Sample

    240904-wr4fcavanm

  • MD5

    f8dde89755e116bda385509127da4133

  • SHA1

    3a0ffeaf224c65deb2d5b8091133a984be408fab

  • SHA256

    9089bccfa710cd957de9f0fd104404567761ff673e6825c0348fd32be2b17b19

  • SHA512

    7cbe4a4654402c6bfe136efd3cfdc9a1b535e3ea26a8c002aa3dd2cc07dd65c3cfcd787edbe28d561d2b166d06b80645ed537521469cb04ed6a9a44717ee059c

  • SSDEEP

    49152:1cfTq24GjdGSiqkqXfd+/9AqYanieKdQ1:1cOEjdGSiqkqXf0FLYW

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1280952350231629894/1mdRkbbzR_6C99iW4uWgeL0y_HGUMMZhQ7G13dDZ5FnZ3YEBxLJWQ0E9wnPwPV33a-oK

Targets

    • Target

      USBDeviceDriver.exe

    • Size

      1.6MB

    • MD5

      f8dde89755e116bda385509127da4133

    • SHA1

      3a0ffeaf224c65deb2d5b8091133a984be408fab

    • SHA256

      9089bccfa710cd957de9f0fd104404567761ff673e6825c0348fd32be2b17b19

    • SHA512

      7cbe4a4654402c6bfe136efd3cfdc9a1b535e3ea26a8c002aa3dd2cc07dd65c3cfcd787edbe28d561d2b166d06b80645ed537521469cb04ed6a9a44717ee059c

    • SSDEEP

      49152:1cfTq24GjdGSiqkqXfd+/9AqYanieKdQ1:1cOEjdGSiqkqXf0FLYW

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks