Extracted

• • Target
    build.exe
  • Size 1.5MB
  • SHA256 f8e99639959da57afc353cd9f1b6270d6f5e3a0f661daeb927188a3d6665f346
  • MD5 c094b0fd9538dd8f44faaa1dbd2ff51b
  • SHA1 937ce513ad08b1abd865546ac5a31d7d67ad4c13
  • SHA512 1dbad0eccc42446533517591a8fedca77753e0b8689ed0e0a009397f6b15f9d131d9d8f5c1a5101dcee0c964c009fe94932940b9ca6cb00721db81561818eaf5
  • SSDEEP 24576:zi2Q9NXw2/wPOjdGxYqfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnMa:2Tq24GjdGSgw+W7SCRnVQTEQ/BA8
  • TLSH
    T1A775129873F90904F2BF7FB4D8F210289671F9179C61DA4E1484209D4F35B89AE61B7B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoverystealeriumpersistenceprivilege_escalationspywarestealer

  • Family: Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2