MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08c4dee261a00bcf8f3bf3449359fc316a8fcd9af6e929bfa66d8fde6fc0ce53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MarsStealer


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08c4dee261a00bcf8f3bf3449359fc316a8fcd9af6e929bfa66d8fde6fc0ce53
SHA3-384 hash: 894948403379d01e15178a028d31b1c4e08c0cb2449d734fcfde4655c0db0c795af07cd5cc6b9d39c9ddcd2f9627f51f
SHA1 hash: ee16e9e1d9a99f90aa2ffdde4a63e0649404cb49
MD5 hash: 1584daa7253cc3972b30b961e09a40ca
humanhash: william-alpha-eight-oscar
File name:file
Download: download sample
Signature MarsStealer
Create hunting rule
File size:1'788'928 bytes
First seen:2024-09-17 11:44:06 UTC
Last seen:2024-09-17 11:44:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 24576:t96pu+etiTw3Rl/zJAGxk7nB2RX9vm4Hl2BKuAPWh8iSix8tir85Ckx/I3Tvtkdq:tC3TSRlzJXmnBMvmW2BKjg8ITVDvtZH
TLSH T1278533A57FB3D292EB34CD73192A69CE77165C85E7476CB92E0C26787A4319B3002B31
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Bitsight
Tags:exe MarsStealer


Avatar
Bitsight
url: http://185.215.113.100/steam/random.exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
464
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-09-17 11:45:07 UTC
Tags:
stealer stealc
Link:
https://app.any.run/tasks/18141f71-80d7-46ca-829d-5af1c02d2042

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.994.6481.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66e96bc1f72de0d131be90cf
Tags:
Execution Generic Infostealer Network Stealth Trojan
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/66e96bc3ede3a801b07ec018/reports/d62fb719-7ec2-4ab5-bf6e-8c2910518a07/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/08c4dee261a00bcf8f3bf3449359fc316a8fcd9af6e929bfa66d8fde6fc0ce53
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3a9c41be-0249-4780-8dd3-b0069902e80e
Result
Threat name:
Amadey, Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1512445
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found API chain indicative of debugger detection
Found API chain indicative of sandbox detection
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Amadeys stealer DLL
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1512445 Sample: file.exe Startdate: 17/09/2024 Architecture: WINDOWS Score: 100 52 Multi AV Scanner detection for domain / URL 2->52 54 Suricata IDS alerts for network traffic 2->54 56 Found malware configuration 2->56 58 14 other signatures 2->58 8 file.exe 39 2->8         started        13 svoutse.exe 15 2->13         started        process3 dnsIp4 46 185.215.113.103, 49699, 80 WHOLESALECONNECTIONSNL Portugal 8->46 48 185.215.113.100, 49705, 49708, 80 WHOLESALECONNECTIONSNL Portugal 8->48 34 C:\Users\user\AppData\...\softokn3[1].dll, PE32 8->34 dropped 36 C:\Users\user\AppData\Local\...\random[1].exe, PE32 8->36 dropped 38 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 8->38 dropped 44 13 other files (9 malicious) 8->44 dropped 74 Detected unpacking (changes PE section rights) 8->74 76 Tries to steal Mail credentials (via file / registry access) 8->76 78 Found many strings related to Crypto-Wallets (likely being stolen) 8->78 86 6 other signatures 8->86 15 cmd.exe 1 8->15         started        17 cmd.exe 1 8->17         started        50 31.41.244.10, 49707, 80 AEROEXPRESS-ASRU Russian Federation 13->50 40 C:\Users\user\AppData\...\ca0b714c9d.exe, PE32 13->40 dropped 42 C:\Users\user\AppData\Local\...\random[1].exe, PE32 13->42 dropped 80 Hides threads from debuggers 13->80 82 Tries to detect sandboxes / dynamic malware analysis system (registry check) 13->82 84 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 13->84 file5 signatures6 process7 process8 19 AEBGIEGCFH.exe 4 15->19         started        23 conhost.exe 15->23         started        25 userJJJJKEHCAK.exe 17->25         started        27 conhost.exe 17->27         started        file9 32 C:\Users\user\AppData\Local\...\svoutse.exe, PE32 19->32 dropped 60 Antivirus detection for dropped file 19->60 62 Detected unpacking (changes PE section rights) 19->62 64 Machine Learning detection for dropped file 19->64 72 5 other signatures 19->72 29 svoutse.exe 19->29         started        66 Binary is likely a compiled AutoIt script file 25->66 68 Found API chain indicative of debugger detection 25->68 70 Found API chain indicative of sandbox detection 25->70 signatures10 process11 signatures12 88 Antivirus detection for dropped file 29->88 90 Detected unpacking (changes PE section rights) 29->90 92 Tries to detect sandboxes and other dynamic analysis tools (window names) 29->92 94 5 other signatures 29->94
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/08c4dee261a00bcf8f3bf3449359fc316a8fcd9af6e929bfa66d8fde6fc0ce53
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08c4dee261a00bcf8f3bf3449359fc316a8fcd9af6e929bfa66d8fde6fc0ce53/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-09-17 11:45:05 UTC
File Type:
PE (Exe)
AV detection:
18 of 38 (47.37%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bdcn5ytbuaf47dz36ncjgwp4gfvi7tm263ustp5gnwh5436azzjq._file
Verdict:
malicious
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:stealc botnet:c7817d botnet:rave credential_access discovery evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/240917-nwqq2s1erm/
Behaviour
Checks processor information in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
AutoIT Executable
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Identifies Wine through registry keys
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Downloads MZ/PE file
Credentials from Password Stores: Credentials from Web Browsers
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
Stealc
Malware Config
C2 Extraction:
http://185.215.113.103
http://31.41.244.10
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a9acf396-3409-41aa-a4b0-a8ccb0c716de
Unpacked files
SH256 hash:
622eb343f41a284c73f7ba201e5ff7c6f1065d5f09c5f44f41567d08f0dd35fd
MD5 hash:
303dda0dbf494ab476aefd46e0d14708
SHA1 hash:
56836d50d1fb6cdf62104ca194ec0b1f56613bdc
Detections:
stealc
Create hunting rule
win_stealc_w0
Create hunting rule
win_stealc_a0
Create hunting rule
Link:
https://www.unpac.me/results/252705c7-90bc-45de-8c79-0782a29d05f5/
SH256 hash:
08c4dee261a00bcf8f3bf3449359fc316a8fcd9af6e929bfa66d8fde6fc0ce53
MD5 hash:
1584daa7253cc3972b30b961e09a40ca
SHA1 hash:
ee16e9e1d9a99f90aa2ffdde4a63e0649404cb49
Link:
https://www.unpac.me/results/252705c7-90bc-45de-8c79-0782a29d05f5/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/08c4dee261a0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/08c4dee261a00bcf8f3bf3449359fc316a8fcd9af6e929bfa66d8fde6fc0ce53

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MarsStealer

Executable exe 08c4dee261a00bcf8f3bf3449359fc316a8fcd9af6e929bfa66d8fde6fc0ce53

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3171133/
  
URLhaus
https://urlhaus.abuse.ch/url/3173969/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments