MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ce20355c39691f815eca3acf7e9e6addd4e8e2159297e4afbceef64111a0837. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ce20355c39691f815eca3acf7e9e6addd4e8e2159297e4afbceef64111a0837
SHA3-384 hash: e2f1250128eb6999a78314a6df783562f0338a52769aaf37276a80ed9c71da6bfd1c0390264e1f499536b4e10f9ea852
SHA1 hash: a1e05cb369ed0a24a9aff8066514ede7cd17dba6
MD5 hash: b111b74a7f2979a517bfe4fb6c88fe80
humanhash: mars-oklahoma-leopard-mike
File name:cfDqE00R1M2FHvud1UskY7La.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:259'072 bytes
First seen:2024-02-16 18:37:42 UTC
Last seen:2024-02-16 20:31:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 701b7eda6b324e6e9073377243e2004c (2 x RedLineStealer, 1 x Stealc, 1 x Smoke Loader)
ssdeep 3072:Ib0S8j2zIWWnnMe8TEzBlgkVJ3xlrI6QDJ170Z2z7DlT:IbXC28ZMePakV7/QDzp
Threatray 34 similar samples on MalwareBazaar
TLSH T1BE44CFD0A6E4D031D24325398921DBB24EBB78353962E98F6FDA177A5F287D0D22430F
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.9% (.EXE) Win32 Executable (generic) (4504/4/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 3370ecd2ccf033da (7 x Stealc, 3 x Smoke Loader, 2 x RiseProStealer)
Reporter bobross_malware2
Tags:exe Stealc

Intelligence

File Origin
# of uploads :
2
# of downloads :
302
Origin country :
US US
Vendor Threat Intelligence
Detection:
Stealc
Create hunting rule
Link:
https://www.capesandbox.com/analysis/476529/
Detection(s):
SecuriteInfo.com.Win32.DropperX-gen.25928.12365.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Reading critical registry keys
Changing a file
Creating a file in the %AppData% subdirectories
Creating a window
Launching the default Windows debugger (dwwin.exe)
Connection attempt to an infection source
Stealing user critical data
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint packed
Link:
https://www.filescan.io/uploads/65cfab8b03a1c3a7aeeefdd2/reports/4131a326-4d4b-447b-b23f-3843527dafdc/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/0ce20355c39691f815eca3acf7e9e6addd4e8e2159297e4afbceef64111a0837
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5360bbe2-740d-42c2-af6c-e07291259217
Result
Threat name:
Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1393651
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Searches for specific processes (likely to inject)
Snort IDS alert for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0ce20355c39691f815eca3acf7e9e6addd4e8e2159297e4afbceef64111a0837
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ce20355c39691f815eca3acf7e9e6addd4e8e2159297e4afbceef64111a0837/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-02-16 18:38:05 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
17 of 24 (70.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=btragvods2i7qfpmuowpp2pgvxou5drbleux4sx3z3xwiei2ba3q._file
Verdict:
malicious
Similar samples:
0ce20355c39691f815eca3acf7e9e6addd4e8e2159297e4afbceef64111a0837
Stealc
1cca1e0d2b37b64a068d0d15e53668368011a3809655f40be84034852f4cbbb1
Stealc
5d2d0aadfb9a0f47c7803c207b2f7b5c9efd79261d7f351b367b479788c4d47d
Stealc
8a12a7cfb07d4ea86f212911775850f6187eea3d7a9c070ae2d68e0b318266e5
Stealc
9eda80b21be4608e90d5f90cf721412e929894ce6d077f8bb45365c0f5d1d613
Stealc
9f263f90eaaae77714ef74eab8b799376160bb8bdb3f58c3d987d9e236ebcda8
Stealc
a022daaa10f66f7870e535d0cb76290e5d3d6bba6e73708673c528bdb1417215
Stealc
ba01502b5a5c02dbdddf6a85c50670204b9e47e693cbf37fe58f55b9bbf1f2d0
Stealc
+ 24 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc discovery spyware stealer
Link:
https://tria.ge/reports/240216-w92dpseh32/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Stealc
Malware Config
C2 Extraction:
http://185.172.128.24
Unpacked files
SH256 hash:
3b92b7b8784b277b79660bcd48f2df4fec2316bc8a1fb6c0f0164696d213c44b
MD5 hash:
14184e27c79ce7a06450f1fe921ce963
SHA1 hash:
e942cdc3f58b46ace68be76b24ac1b93bb51d7c1
Link:
https://www.unpac.me/results/ecafe4d2-dadb-479e-9585-ae6c6701a5c0/
SH256 hash:
0ce20355c39691f815eca3acf7e9e6addd4e8e2159297e4afbceef64111a0837
MD5 hash:
b111b74a7f2979a517bfe4fb6c88fe80
SHA1 hash:
a1e05cb369ed0a24a9aff8066514ede7cd17dba6
Link:
https://www.unpac.me/results/ecafe4d2-dadb-479e-9585-ae6c6701a5c0/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0ce20355c396/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0ce20355c39691f815eca3acf7e9e6addd4e8e2159297e4afbceef64111a0837

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:infostealer_win_stealc_standalone
Create hunting rule
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:win_stealc_w0
Create hunting rule
Author:crep1x
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 0ce20355c39691f815eca3acf7e9e6addd4e8e2159297e4afbceef64111a0837

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/476529/
  
URLhaus
https://urlhaus.abuse.ch/url/2754939/
  
Delivery method
Distributed via web download

Comments