Extracted

Extracted

• • Target

    OVALWantlist0325.exe

  • Size

    180KB

  • MD5

    081a892310290038e4ba646c488bad8e

  • SHA1

    b3d36e18d2a94eb5060bb725a1d9a4e70629777d

  • SHA256

    a777a2eec9933c95e419cce77b09cffb73f0c4afcffde00942b9665098aa7fb4

  • SHA512

    44412a2305cd5d34825d2bd3b3857d0a724e57e9aca586e7d50d8314bd2b7cd717f4010c5632bce94452b8a3ddde0b2e4eeb0660bdba7f08309eef58358875f9

  • SSDEEP

    3072:4ZkluvUjaqwHyXzid7sIMcTzMkg8j/xGc5ptYhlcNZ+XayDwVsSrgIN4ftnr:80u3SXzIvng8N3tMM+qw

  Score

  10^/10

  stealeriumcollectioncredential_accessdiscoverypersistenceprivilege_escalationspywarestealer

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Stealerium family

    stealerium

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1