Extracted

• • Target

    RLTool.dll

  • Size

    13KB

  • MD5

    f05d4fc886f3a83be6f076941f8fa669

  • SHA1

    f2679402f45ebb3d6dc79ee204061d71eb6ba4ee

  • SHA256

    e574a9a0a146fb842332f480d7104824d4e52525d91a9c0e3225f817ea4e6ef8

  • SHA512

    19784eae098912158998fc8806a844497ed47afbe19a9f1a72021d26b0ca316eec33aa7faf202dafc9d5c06ce567bc10382fd907ed6f047ea8688cfdc3d32d86

  • SSDEEP

    384:ydm/klk7qv55LvQKrPhrIDfonEFrFx3X:AvtwWE3xH

  Score

  1^/10
  behavioral1behavioral2

• • Target

    RLTool.exe

  • Size

    135KB

  • MD5

    d8dd178edd900a25706432da4168433c

  • SHA1

    6f97a417179ddcec0a90eeee4dffd76aa2602537

  • SHA256

    1e2b6bfb5d47fef87162614b2c6e5cecd46ce78a1d5cf7ea1744bc49dde8db5f

  • SHA512

    6f4b1e2c6c35136899f552c127d992ba30d505ba20f0d5da73801d43d1b1c0a7eb4029a544f5f5eb46a350c7555d4e6c6be6c55db33c4c6a7363f827b68857d8

  • SSDEEP

    3072:DjK4UGDHXrQ8hy7qgpHulWD9ZvZ5Pf3Ca10xuZ04ntfO6hBut:DjK4TDUqgpqWDLZ5H+xuZ04FhA

  Score

  10^/10

  stealeriumcollectiondiscoveryevasionpersistenceprivilege_escalationransomwarespywarestealer

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Disables cmd.exe use via registry modification

    evasion

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral3behavioral4