MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01777810e2b9edaa543fb7be8a238a442cb070cc4838b5a1263ffba65d7e1845. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 16


Intelligence 16 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01777810e2b9edaa543fb7be8a238a442cb070cc4838b5a1263ffba65d7e1845
SHA3-384 hash: e7afd9ac84e6b26496748ba60a70a4644fcfbee388060c7d8a65871e0850a2621646fedb50a8d7fc7db824ffb8a87f16
SHA1 hash: 86c01585ff4ca9028b9474ea47c2c6a7ef80a5fb
MD5 hash: db68fd095d66238a633dd86623f4305d
humanhash: alanine-angel-fillet-edward
File name:file
Download: download sample
Signature Stealc
Create hunting rule
File size:8'847'488 bytes
First seen:2025-12-11 13:43:46 UTC
Last seen:2025-12-12 01:19:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4035d2883e01d64f3e7a9dccb1d63af5 (47 x ServHelper, 30 x Vidar, 20 x LummaStealer)
ssdeep 49152:77P13TRLuRL9JZ9SE8u7hyvvmatjW6jXc6:N3SM2gbtjx
TLSH T1F6963AA1B9A54555C65BF034916062A3B671BC1A43323BDB5FEC0E6A0C7EBC0273EF19
gimphash 9aefd65fa0b91dfc51b1baabc61c53c4434947d8de5ec67b8f621e8f0a31c5db
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:BB1.file dropped-by-gcleaner exe Stealc x


Avatar
Bitsight
url: http://194.38.20.224/service

Intelligence

File Origin
# of uploads :
8
# of downloads :
125
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
Going
Details
Link:
https://research.acce.ciphertechsolutions.com/results/9617c9a8-fc25-494f-98ac-88b76b12df6a/
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2025-12-11 13:44:53 UTC
Tags:
stealc stealer
Link:
https://app.any.run/tasks/130ce955-5e67-4886-9109-517f67eb759c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Stealc
Create hunting rule
Link:
https://www.capesandbox.com/analysis/44291/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=693acab4a675b653bd10195f
Tags:
injection emotet obfusc crypt
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/01777810e2b9edaa543fb7be8a238a442cb070cc4838b5a1263ffba65d7e1845
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-10T07:46:00Z UTC
Last seen:
2025-12-13T00:23:00Z UTC
Hits:
~10
Detections:
Trojan-PSW.Win64.StealC.sb Trojan.MSIL.Agent.sb HEUR:Trojan.Win64.Generic Trojan-PSW.Lumma.HTTP.C&C Trojan-PSW.Win32.StealC.v2
Link:
https://opentip.kaspersky.com/01777810e2b9edaa543fb7be8a238a442cb070cc4838b5a1263ffba65d7e1845/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/aa8c9708-1a9a-4942-ab7a-af62b5bd795c
Score:
59%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/01777810e2b9edaa543fb7be8a238a442cb070cc4838b5a1263ffba65d7e1845
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/db68fd095d66238a633dd86623f4305d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/01777810e2b9edaa543fb7be8a238a442cb070cc4838b5a1263ffba65d7e1845/
Verdict:
Malicious
Threat:
Family.STEALC
Link:
https://tip.neiki.dev/file/01777810e2b9edaa543fb7be8a238a442cb070cc4838b5a1263ffba65d7e1845
Threat name:
Win64.Trojan.ShellLoader
Create hunting rule
Status:
Malicious
First seen:
2025-12-11 14:22:08 UTC
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=af3xqehcxhw2uvb7w67iui4kiqwla4gmja4llijgh752mxl6dbcq._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
Similar samples:
error
Stealc
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:nerino discovery stealer
Link:
https://tria.ge/reports/251211-q1ycssspfz/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Stealc
Stealc family
Malware Config
C2 Extraction:
http://45.93.20.34
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/db41a0dc-d16e-442b-98a0-13f82b4aeb34
Unpacked files
SH256 hash:
01777810e2b9edaa543fb7be8a238a442cb070cc4838b5a1263ffba65d7e1845
MD5 hash:
db68fd095d66238a633dd86623f4305d
SHA1 hash:
86c01585ff4ca9028b9474ea47c2c6a7ef80a5fb
Link:
https://www.unpac.me/results/d93e204c-2cf5-4555-a2ed-17f0740caf33/
Malware family:
Stealc.v2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/01777810e2b9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/01777810e2b9edaa543fb7be8a238a442cb070cc4838b5a1263ffba65d7e1845

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 01777810e2b9edaa543fb7be8a238a442cb070cc4838b5a1263ffba65d7e1845

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/44291/

Comments