Extracted

• • Target

    build.exe

  • Size

    1.6MB

  • MD5

    a5b27249ecbe247acfc5cf83273d8665

  • SHA1

    95750f6e9ad5575a8ecdfa166360803bae106dea

  • SHA256

    16cfc79d7df881059cd59a5bc0fe4211e55a49105eca41810c0fb2a81f1b5fac

  • SHA512

    0d09d902ea81803b215fd48851fab45e73742468a445699bcb3f167b5a5f624aa15e16e06f30fcbb982f097f234a03794ad90a997895a7ad2204eead2ce93ea0

  • SSDEEP

    24576:Ci2Q9NXw2/wPOjdGxY2rJxkqjVnlqud+/2P+A+ZecdyFoBkkAqmZywW0n:1Tq24GjdGSiJxkqXfd+/9AqYanCLW

  Score

  10^/10

  stealeriumcollectioncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2