MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15548dc4aab59a1ecc65d7cbe37b2a6224e8be7682621e8f6b9ed851ab6f4e97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	15548dc4aab59a1ecc65d7cbe37b2a6224e8be7682621e8f6b9ed851ab6f4e97
SHA3-384 hash:	ef7b240fdfad8d71ade433c2f694541c4c3af216a68e1570c3825a28ae423853dc99a520b473f2dc5ec9dcedf1ba8af0
SHA1 hash:	c26195a24760f7c6621c63bf79b8d1f36e3ec04b
MD5 hash:	125a5c30fd99f5f53b2914e9f6cf1627
humanhash:	moon-ink-lake-idaho
File name:	SecuriteInfo.com.Python.Stealer.1190.23622.5282
Download:	download sample
Signature	CrealStealer Alert Create hunting rule
File size:	13'815'856 bytes
First seen:	2023-12-19 18:19:44 UTC
Last seen:	2023-12-20 14:15:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1af6c885af093afc55142c2f1761dbe8 (49 x PythonStealer, 40 x BlankGrabber, 14 x LunaLogger)
ssdeep	393216:iiIE7YoSD2nwW+eGQRIMTozGxu8C0ibfz6e57Z1bmXdWCUI:L7rSDawW+e5R5oztZ026e5DkVUI
TLSH	T192D63386B3800CB5E6E3813641664427E377F9611320D6AE23B5F2661BBF3478E3DE95
TrID	66.5% (.EXE) InstallShield setup (43053/19/16) 16.2% (.EXE) Win64 Executable (generic) (10523/12/4) 7.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.1% (.EXE) OS/2 Executable (generic) (2029/13) 3.0% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	c6c2ccc4f4e0e0f8 (37 x PythonStealer, 21 x CrealStealer, 19 x Empyrean)
Reporter	SecuriteInfoCom
Tags:	CrealStealer exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

349

Origin country :

FR

Vendor Threat Intelligence

ANY.RUN guloader

Malware family:

guloader

Alert

Create hunting rule

ID:

1

File name:

New Text Document.exe

Verdict:

Malicious activity

Analysis date:

2023-12-20 06:10:48 UTC

Tags:

opendir loader guloader stealer redline vodkagats ransomware stop agenttesla purplefox backdoor lumma risepro formbook spyware xloader evasion dupzom trojan servstart

Link:

https://app.any.run/tasks/e8a6a532-0176-4c82-bb0d-c98f92b676d0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.Python.Stealer.1190.23622.5282.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% subdirectories

Restart of the analyzed sample

Using the Windows Management Instrumentation requests

Running batch commands

Creating a process with a hidden window

Launching a process

Searching for synchronization primitives

Creating a file

Reading critical registry keys

Creating a file in the %AppData% subdirectories

DNS request

Delayed reading of the file

Sending a custom TCP request

Launching a tool to kill processes

Enabling autorun by creating a file

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

control expand lolbin masquerade overlay packed packed pyinstaller python

Link:

https://www.filescan.io/uploads/6581ded56b1c246046fc76c3/reports/b70a38e5-cc39-4c83-a91f-be3a6d112a0d/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/15548dc4aab59a1ecc65d7cbe37b2a6224e8be7682621e8f6b9ed851ab6f4e97

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/ce7197a2-31c4-41ee-a6a3-28ea05ec07c8

Joe Sandbox Creal Stealer

Result

Threat name:

Creal Stealer

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.adwa.spyw.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1364734

Signature

Antivirus / Scanner detection for submitted sample

Drops PE files to the startup folder

Found malware configuration

Multi AV Scanner detection for submitted file

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Creal Stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/15548dc4aab59a1ecc65d7cbe37b2a6224e8be7682621e8f6b9ed851ab6f4e97

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/15548dc4aab59a1ecc65d7cbe37b2a6224e8be7682621e8f6b9ed851ab6f4e97/

ReversingLabs TitaniumCloud Win64.Trojan.ReverseShell

Threat name:

Win64.Trojan.ReverseShell

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-13 09:46:51 UTC

File Type:

PE+ (Exe)

Extracted files:

1163

AV detection:

17 of 37 (45.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cvki3rfkwwnb5tdf27f6g6zkmisorptwqjrb5d3lt3mfdk3pj2lq._file

Threatray unknown

Verdict:

unknown

Hatching Triage crealstealer

Result

Malware family:

crealstealer

Alert

Create hunting rule

Score:

  10/10

Tags:

family:crealstealer pyinstaller

Link:

https://tria.ge/reports/231219-wyqstscdgn/

UnpacMe PyInstaller

Unpacked files

SH256 hash:

15548dc4aab59a1ecc65d7cbe37b2a6224e8be7682621e8f6b9ed851ab6f4e97

MD5 hash:

125a5c30fd99f5f53b2914e9f6cf1627

SHA1 hash:

c26195a24760f7c6621c63bf79b8d1f36e3ec04b

Detections:

PyInstaller

Alert

Create hunting rule

Link:

https://www.unpac.me/results/95af8ee4-655b-4a9b-b21e-c2ac3e7f4523/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/15548dc4aab59a1ecc65d7cbe37b2a6224e8be7682621e8f6b9ed851ab6f4e97