Extracted

• • Target
    build.exe
  • Size 1.5MB
  • SHA256 8ad036cae17eb11d0460b804ce916e593929fe2b4155c1e84f5cf19cadf801cb
  • MD5 7d8467911ec86f4340b0a05683ede27d
  • SHA1 8aeb34e2d0e799d8e0841b1d2ab10ed6cd23a81e
  • SHA512 c06343d3ef29904d4807d688909e87f5ee4af67c70cb7df357a76af414aa9a5322b9e9fa19b43c95962d019a5588174470f1e58abf237c3cade59e2bf3d85f4f
  • SSDEEP 24576:Dggi2Q9NXw2/wPOjdGxYqfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnC:DSTq24GjdGSgw+W7SCRnVQTEQ/BA8
  • TLSH
    T16075129973E90E04F3BF7FB8ACF110699A71F8178C21D64E1485206D0B35B89AE61B77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoverystealeriumpersistenceprivilege_escalationspywarestealeradwareransomware

  • Family: Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2