Overview

overview

10

Static

static

10

reload-beta.exe

windows10-2004-x64

10

reload-beta.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    reload-beta.exe

  • Size

    1.6MB

  • Sample

    240630-vpdaps1djh

  • MD5

    281d200e4d94f020e9945e3812aec967

  • SHA1

    7738475daded508bd105bd296d1f47ae05febe68

  • SHA256

    15973284c2f6be38e8ab31e01d3d0a59d87ff03c98126754a61283265cd769e3

  • SHA512

    600e54b853cbf68f3862728d80f0ff1ad835b6baa6dbe57e2e28e81a90d4026ee56a7b395f322b353dde018369084bc45fb470fd550d231f06b39522c75aa9b0

  • SSDEEP

    49152:hkTq24GjdGSiqkqXfd+/9AqYanieKdsX:h1EjdGSiqkqXf0FLYW

Score
10/10
stealeriumcollectionpersistenceprivilege_escalationspywarestealer

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1257008132761194659/j4YbzwxG41tBMUV2ew7ukKuFT4XUWR1j2htz3bWYzHr9A_UbewGf2LUD0JL44NpvUur-

Targets

    • Target

      reload-beta.exe

    • Size

      1.6MB

    • MD5

      281d200e4d94f020e9945e3812aec967

    • SHA1

      7738475daded508bd105bd296d1f47ae05febe68

    • SHA256

      15973284c2f6be38e8ab31e01d3d0a59d87ff03c98126754a61283265cd769e3

    • SHA512

      600e54b853cbf68f3862728d80f0ff1ad835b6baa6dbe57e2e28e81a90d4026ee56a7b395f322b353dde018369084bc45fb470fd550d231f06b39522c75aa9b0

    • SSDEEP

      49152:hkTq24GjdGSiqkqXfd+/9AqYanieKdsX:h1EjdGSiqkqXf0FLYW

    Score
    10/10
    stealeriumcollectionpersistenceprivilege_escalationspywarestealer

    • Stealerium

      An open source info stealer written in C# first seen in May 2022.

      stealerstealerium

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks