Extracted

• • Target
    build.exe
  • Size 1.5MB
  • SHA256 f2111f51baf434cb654d65c4aa785950f670016560be634544737d0b54dee6ab
  • MD5 4f41baee76c481c16e2691bc02a8a22c
  • SHA1 4cd2b62801b68f0cf4dac88eb7bf77bac9947edb
  • SHA512 fb5b8a248fff3b07c3bd98c58dd08b3ca88c61b7b8bf42b26a017a931241b16a53bab8ea2ddf47f63dc555eb41babedb70e4de4585e156984cc4c3137edfcc7e
  • SSDEEP 24576:R5jYi2Q9NXw2/wPOjdGxYqfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnCU:rHTq24GjdGSgw+W7SCRnVQTEQ/BA8
  • TLSH
    T12F75129473F90904F3BF7FB8ACF210649A71F9279861D64E1485205D0F32B89AD62B7B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverystealeriumstealercollectionpersistenceprivilege_escalationspyware

  • Family: Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  behavioral1behavioral2