Extracted

• • Target

    net8.0-windows.rar

  • Size

    69KB

  • MD5

    f5c0cace207517b9cb2d92a1f6a2fa9c

  • SHA1

    262b21de4b8a0b1c34269e65cba66215520d4983

  • SHA256

    2aba1393ad9d161d34c473e633196be971ac8d13a988fb4206568d739a8b5cfb

  • SHA512

    e53b510ac48352eb437943b0cbafd5de3f2ca22afc5d58d54af0a639d1d927a71fe3d5b6f65b476536d9f66a2639bd1ebaf482b07ab6d796d6df4c5d31a4243c

  • SSDEEP

    1536:ZUHUX4uLyZy2Jd9PEBiKx2qfE65xSXZrfjzgjepCrdQeGm:0Uou32rFEBiK8qsU0XFd+Gm

  Score

  10^/10

  stealeriumcollectiondiscoveryevasionpersistenceprivilege_escalationransomwarespywarestealer

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Disables cmd.exe use via registry modification

    evasion

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2

• • Target

    RLTool.deps.json

  • Size

    410B

  • MD5

    586c28961367aced67554723dc189e23

  • SHA1

    a71d04f6f38c7212b51be1fe7ec9f837186e5d43

  • SHA256

    66be7442a542430779c91364e838b9d186539d11c7e6b2555ea63e3740b90631

  • SHA512

    93b7b9472ffb4922ded3f298c0f65fc18f3cf606c4630348278efc415c5101b53c2e0df362368f8bbcbb580a6842db55dd10703f810c6345e169c2069ec2d16a

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    RLTool.dll

  • Size

    13KB

  • MD5

    f05d4fc886f3a83be6f076941f8fa669

  • SHA1

    f2679402f45ebb3d6dc79ee204061d71eb6ba4ee

  • SHA256

    e574a9a0a146fb842332f480d7104824d4e52525d91a9c0e3225f817ea4e6ef8

  • SHA512

    19784eae098912158998fc8806a844497ed47afbe19a9f1a72021d26b0ca316eec33aa7faf202dafc9d5c06ce567bc10382fd907ed6f047ea8688cfdc3d32d86

  • SSDEEP

    384:ydm/klk7qv55LvQKrPhrIDfonEFrFx3X:AvtwWE3xH

  Score

  1^/10
  behavioral5behavioral6

• • Target

    RLTool.exe

  • Size

    135KB

  • MD5

    d8dd178edd900a25706432da4168433c

  • SHA1

    6f97a417179ddcec0a90eeee4dffd76aa2602537

  • SHA256

    1e2b6bfb5d47fef87162614b2c6e5cecd46ce78a1d5cf7ea1744bc49dde8db5f

  • SHA512

    6f4b1e2c6c35136899f552c127d992ba30d505ba20f0d5da73801d43d1b1c0a7eb4029a544f5f5eb46a350c7555d4e6c6be6c55db33c4c6a7363f827b68857d8

  • SSDEEP

    3072:DjK4UGDHXrQ8hy7qgpHulWD9ZvZ5Pf3Ca10xuZ04ntfO6hBut:DjK4TDUqgpqWDLZ5H+xuZ04FhA

  Score

  1^/10
  behavioral7behavioral8

• • Target

    RLTool.pdb

  • Size

    14KB

  • MD5

    6f6d3f30c60fdc60dcd10c4b13bf72a0

  • SHA1

    775da21bdf30829dc16829925c3410d56b9c6f4c

  • SHA256

    2cd387280e7695845791270b2e2e24b32598ae954c6e133091d06cbd8921351e

  • SHA512

    02b5bfa73afb7ad855698c22ad601f559aa3c79735d12a3571b149f81f8e2eb5fb71cb20f5d6fda84591aa38ec9458b5e145bedbb2dc636d6161dbdb3f736464

  • SSDEEP

    384:f/pZ41dtB10dapq/6PhR+6KhBiHuBE9a7d0+2uAuVo73HafyEVAn1wh1WNhcsnVX:Hp2L9244ZtAivAVK9jW

  Score

  3^/10

  discovery
  behavioral10behavioral9

• • Target

    RLTool.runtimeconfig.json

  • Size

    386B

  • MD5

    186a65581e2f29258f54d396660409fa

  • SHA1

    6f998d3be2e85cb5419205f867135874f27c0a3a

  • SHA256

    e1e0974d0e8833375024eb7c78521b3b5cad4228aad22b23d506cbe702445844

  • SHA512

    7dea87b523aab01ea3c794779b71bc0b52179e1d5e7b9a45539ddd39c775969ef22853c4c193699aec1e3fa3cbe26e90e3a4881226c52a3aacae1eac260ff896

  Score

  3^/10

  discovery
  behavioral11behavioral12