Extracted

• • Target
    build.exe
  • Size 1.5MB
  • SHA256 3399703c0503e6f1a42ea2e848cf209e010f488e942fa2d11b89e08b9ea02c59
  • MD5 339075d0287f4ffc29b0da43cea90986
  • SHA1 e4748ea53ceaa8b5f30fbb796cd87306e1842b11
  • SHA512 9b8503063868bf04d939f73e0a3c57429be48b5d98c71727b1534f790c69e4b1b7b3288bfc211b7c3b1d19d8fed3b0eec8658008be6884862d95573ed6ea8dd1
  • SSDEEP 24576:lYi2Q9NXw2/wPOjdGxYqfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnvT:5Tq24GjdGSgw+W7SCRnVQTEQ/BA8
  • TLSH
    T1E875129473F90904F7BF6FB4ECF201649671F5578C62E69E1984205C0F22B4A9E21BBB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoverystealeriumpersistenceprivilege_escalationspywarestealer

  • Family: Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2