Extracted

• • Target
    build.exe
  • Size 1.5MB
  • SHA256 08998e78c6c92ce6d668ed199a6e15fb29575930b0cd63b00b7580aa967332f4
  • MD5 2ed814ef2d59f33bcfd1fd1e80f1398a
  • SHA1 ffe7a99f7fd5b07d8906db2454c57a4781f333a8
  • SHA512 922d1632f1b2bff8b1e5864bc37e1f681006df20deb58487053df55456de65f1705370a932c4e87fd7d406b79e9e78efa291861492f7949504af883a52ebda13
  • SSDEEP 24576:HSi2Q9NXw2/wPOjdGxYqfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnQ1:FTq24GjdGSgw+W7SCRnVQTEQ/BA8
  • TLSH
    T1AE751294B3E90D04F3FF6FF5ACF100659671F8279912D64E2889205C0F26F8A9D61BA7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverystealeriumstealeradwarecollectionpersistenceprivilege_escalationransomwarespyware

  • Family: Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2