Extracted

• • Target

    Listado Facturas.exe

  • Size

    6KB

  • MD5

    742079be072c5dc399608789694170d7

  • SHA1

    516b4f2a968cfbf8f5b8ccc1628ef9503b72d6f4

  • SHA256

    c060dd4aacd412f34349d8e246be541a3454f4af199a55eb6ceb92b5c2d21b97

  • SHA512

    322601fa5267e9de1e080be1cbfbfb5359159a02e385a8cd4d5d476e2494c16380eea667329ee95da84dcf959bb95ec68ce3f657e1e5eeb4a0a68c74b2375179

  • SSDEEP

    96:8878k+v/IRAsqj3tA7shArR5QjvfyEzNt:8Bb/+63W7SAD+vfyu

  Score

  10^/10

  stealeriumcollectioncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2