Erbium | Threat Level: high | Type: Infostealer

Cryptographic Identifiers

SHA25604642249b0ad41b1c6cc8862ec372c3b9b1e855d104a16a6a3fae694cc23ec0c
MD51ef9c948e6045d8d8794a89cc9545b0f
File Typeexe
Size819.6 KB
First Seen2022-08-07
File NameDefault@Geroin.exe
TagsErbium, ErbiumStealer, exe

Malware Family: Erbium

Erbium, oyun stealer'dır.

TypeInfostealer
Programming LanguageC++
Target PlatformWindows
C2 ProtocolHTTP
PurposeOyun hedefli stealer
First Seen Year2022

Threat Indicators (IOC)

  • SHA256: 04642249b0ad41b1c6cc8862ec372c3b9b1e855d104a16a6a3fae694cc23ec0c
  • MD5: 1ef9c948e6045d8d8794a89cc9545b0f

You can verify all hash values of this sample on VirusTotal.

System Cleanup Guide

  1. Disconnect the system from the network immediately
  2. Yeni bir cihazdan banka hesabı, sosyal medya ve e-posta şifrelerini değiştirin
  3. Move crypto wallets to a new address and abandon the old ones
  4. Start a full scan with up-to-date antivirus
  5. Clear saved browser passwords and enable 2FA
  6. Sign out of all sessions on every affected service

YARA Rule Hints

rule Erbium_SHA256 {
    meta:
        description = "Erbium sample: 04642249b0ad41b1"
        threat_level = "high"
        first_seen = "2022-08-07"
    condition:
        hash.sha256(0, filesize) == "04642249b0ad41b1c6cc8862ec372c3b9b1e855d104a16a6a3fae694cc23ec0c"
}

Erbium — Malware Profile

Erbium, 2022 de ortaya cikan Rust tabanli premium infostealer ailesidir. 30+ kripto cuzdan, tarayici, Discord, Steam hedefler. $100/ay abonelik.

Malware Type
Infostealer
Programming Language
C++
C2 Protocol
HTTP
Target Systems
Windows

Technical Details

C++, HTTP/HTTPS C2 (JSON), genis tarayici destegi (chromium/firefox), kripto wallet extension stealer (60+), Discord/Steam token, 2FA app stealer, screenshot, clipboard hijacker

Capabilities & Behavior

Tarayıcı Kimlik Bilgileri
Çerez Hırsızlığı
Kripto Cüzdan Çalma
Sistem Bilgisi
Ekran Görüntüsü
FTP/SSH İstemci Şifreleri
E-posta İstemcisi Çalma
Veri Sızıntısı

IOC List (2 indicators)

IOC — Erbium
# SHA256 04642249b0ad41b1c6cc8862ec372c3b9b1e855d104a16a6a3fae694cc23ec0c # MD5 1ef9c948e6045d8d8794a89cc9545b0f
TypeValueNote
sha256 04642249b0ad41b1c6cc8862ec372c3b9b1e855d104a16a6a3fae694cc23ec0c Sample:Erbium
md5 1ef9c948e6045d8d8794a89cc9545b0f Sample:Erbium
Tags
erbiuminfostealermalwarehighsha256hash-analizi