Extracted

• • Target

    FACTURAS.exe

  • Size

    95KB

  • MD5

    e945c5efd46a03fec5ab5c1d77b64e23

  • SHA1

    c9b3edb25d29613fc859d0c6d24bea02f3031c3b

  • SHA256

    5d2dd8452a0048b9d23499187fafc6e2cfd25efb72eee7f92657352e954bc160

  • SHA512

    56724b9a9271fc87e57b0b042c4d6d5935ca604e24f10e06183a3612590aa15bdbf1bf1f020eeae45b10c611d591acd42d80c0dd3f923df93ba8615d5b314fbf

  • SSDEEP

    1536:DGAIyl4VuPPlAlqFuJp2JxhVtPd9YebC+AARivhbv:aAI8QAFfPwVdhbv

  Score

  10^/10

  stealeriumcollectioncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2