MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1587857ad744c322a2b32731cdd48d98eac13f8aa8ff2f2afb01ebba88d15359. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1587857ad744c322a2b32731cdd48d98eac13f8aa8ff2f2afb01ebba88d15359
SHA3-384 hash: 3d1e6940402588902f8f37d7fa870c50464cb3f5d10d8934b511a6136262d1382dda0309648f12b062f03cd54643c38e
SHA1 hash: 88d5af2c79bb46165c7e9c56dcf6306f7fa204be
MD5 hash: 79ac902c20628bbee40a8db4d532fc57
humanhash: carbon-asparagus-social-wisconsin
File name:Tissue.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:2'400'256 bytes
First seen:2023-02-21 15:22:55 UTC
Last seen:2023-02-21 16:29:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 039032eedb13fb00811bf4343043c31c (3 x Stealc)
ssdeep 49152:nbAOGbTSWSsSsg5e9wuLGtp9FqJPqJpsfq9SXLBXbwWMObh/NO3GD8J:bXGbTSWBSJeWuLGZFqxqJpWq9CLtbwWk
Threatray 1'309 similar samples on MalwareBazaar
TLSH T1FEB5183A9E025596E8DD0AF00A5DBAE4E07B0939D55518593F8F3CACB4F27A383EC153
TrID 28.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
25.5% (.EXE) Win32 Executable (generic) (4505/5/1)
11.6% (.ICL) Windows Icons Library (generic) (2059/9)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon c8e2eae6a292c2ce (1 x Stealc)
Reporter plebourhis
Tags:exe Stealc


Avatar
plebourhis
C2 main URL: `hxxp://162.0.238.]10/752e382b4dcf5e3f.php`
C2 directory to download DLLs: `hxxp://162.0.238.]10/dbe4ef521ee4cc21/`

Stealc drop another payload hosted at `hxxp://193.38.55.]218/1.exe` whose C2 is `45.84.121.]44` (SHA-256: 6542f8dc32c2b9717fd86620d128374707684703) Laplas Clipper.

Intelligence

File Origin
# of uploads :
2
# of downloads :
275
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
15
Verdict:
Malicious activity
Analysis date:
2023-02-21 06:29:54 UTC
Tags:
stealer loader trojan
Link:
https://app.any.run/tasks/4c522a81-e8d0-46b6-bbb6-ae0ed1677311

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/368696/
Detection(s):
SecuriteInfo.com.Variant.Tedy.265640.24439.18919.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending an HTTP GET request
Creating a file
Reading critical registry keys
Changing a file
Creating a file in the %temp% directory
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Stealing user critical data
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/71990/overview
Behaviour
MalwareBazaar
Verdict:
No Threat
Threat level:
  2/10
Confidence:
67%
Tags:
packed
Link:
https://www.filescan.io/uploads/63f4e1d7b53d126ad2635fa1/reports/f3257708-0cfb-43d6-9cf7-e6250d337352/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1587857ad744c322a2b32731cdd48d98eac13f8aa8ff2f2afb01ebba88d15359
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/39ba791f-2852-4946-b30c-2cc8bdc40087
Result
Threat name:
Laplas Clipper, Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1179891
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after checking locale)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Snort IDS alert for network traffic
Tries to detect virtualization through RDTSC time measurements
Tries to evade analysis by execution special instruction (VM detection)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Laplas Clipper
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 812722 Sample: Tissue.exe Startdate: 21/02/2023 Architecture: WINDOWS Score: 100 41 Snort IDS alert for network traffic 2->41 43 Antivirus detection for URL or domain 2->43 45 Antivirus / Scanner detection for submitted sample 2->45 47 10 other signatures 2->47 8 Tissue.exe 19 2->8         started        13 ntlhost.exe 2->13         started        15 ntlhost.exe 2->15         started        process3 dnsIp4 35 193.38.55.218, 49686, 80 SERVERIUS-ASNL Russian Federation 8->35 37 37.120.238.190, 49683, 80 SECURE-DATA-ASRO Romania 8->37 31 C:\Users\user\AppData\...\DHDHCGHDHI.exe, PE32 8->31 dropped 33 C:\Users\user\AppData\Local\...\1[1].exe, PE32 8->33 dropped 57 Detected unpacking (changes PE section rights) 8->57 59 Tries to harvest and steal browser information (history, passwords, etc) 8->59 61 Found evasive API chain (may stop execution after checking locale) 8->61 63 Tries to steal Crypto Currency Wallets 8->63 17 cmd.exe 1 8->17         started        65 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 13->65 67 Hides threads from debuggers 13->67 file5 signatures6 process7 process8 19 DHDHCGHDHI.exe 1 2 17->19         started        23 conhost.exe 17->23         started        file9 29 C:\Users\user\AppData\Roaming\...\ntlhost.exe, PE32 19->29 dropped 49 Multi AV Scanner detection for dropped file 19->49 51 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 19->51 53 Machine Learning detection for dropped file 19->53 55 3 other signatures 19->55 25 ntlhost.exe 19->25         started        signatures10 process11 dnsIp12 39 45.84.121.44, 80 SAYFANETTR Georgia 25->39 69 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 25->69 71 Tries to evade analysis by execution special instruction (VM detection) 25->71 73 Tries to detect virtualization through RDTSC time measurements 25->73 75 Hides threads from debuggers 25->75 signatures13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1587857ad744c322a2b32731cdd48d98eac13f8aa8ff2f2afb01ebba88d15359/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2023-02-18 23:07:27 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
22 of 39 (56.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cwdyk6wxitbsfivte4y43ventdvmcp4kvd7s6kx3ahv3vcgrknmq._file
Verdict:
malicious
Similar samples:
2a8e2ab611c7ea1a7c4e7b6fd50cef0a812ae4921a66d25106a039c90582ce29
Stealc
34ec272be14b0de074ccaa9a4b2996e6e92579f94905ed20f3370d39e41fd2a3
Stealc
505d85e3f2cc036bd585825a9bf3fd03a90a849d76dc29e842a1b3725d0b86ce
Stealc
712c853955c56e27e3e4538978fa89018cdc5e5f56944ea0da2fc1a672adc73c
Stealc
77570db1195a42024717d6223e0c55bc77e0246080b2fa7de24eac97391cdeda
Stealc
aa0efd425ea2c4c1d8ab3e78d6b52c8be35173672df7811842f946a3283ad128
Stealc
b06c5fb7651b8a6c683b62babcabd18da4d992f7d1e0f963c530832b18feacf4
Stealc
ca4028b174f018a8401ebefb72d595dad12c12a9ee7209d2fc8993c0c25f3c4d
Stealc
d994d8264d8511cb16ce67ed790a7896d0dbbe44d36eaffb43643ff34f3dc177
Stealc
fadd57bfef9fe4d5a74bc4a5a23e7218c7390d7b1954c0dfed8df2eaea1f6b2f
Stealc
+ 1'299 additional samples on MalwareBazaar
Result
Malware family:
laplas
Create hunting rule
Score:
  10/10
Tags:
family:laplas clipper discovery persistence spyware stealer
Link:
https://tria.ge/reports/230221-ssftwshb7w/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Laplas Clipper
Malware Config
C2 Extraction:
http://45.84.121.44
Unpacked files
SH256 hash:
6306ecde0f6b389f6846d6ef5c87dca9c0114327446ce5d1e4a2cf18f71ab968
MD5 hash:
e1f3f519a39edf3ad22f74092c719559
SHA1 hash:
a334c649656c0c5c2601d0535d1288a548808fc1
Link:
https://www.unpac.me/results/34159a3d-0d95-4ddd-ac2d-1c68e0150c97/
SH256 hash:
1587857ad744c322a2b32731cdd48d98eac13f8aa8ff2f2afb01ebba88d15359
MD5 hash:
79ac902c20628bbee40a8db4d532fc57
SHA1 hash:
88d5af2c79bb46165c7e9c56dcf6306f7fa204be
Link:
https://www.unpac.me/results/34159a3d-0d95-4ddd-ac2d-1c68e0150c97/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1587857ad744c322a2b32731cdd48d98eac13f8aa8ff2f2afb01ebba88d15359

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/
Malpedia
Malpedia
https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Cape
Cape
https://www.capesandbox.com/analysis/368696/

Comments