MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15e097cb7f04bed91a7502e9a11b1c1fd9498fcece521438c5b772a39ae531e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 12

Intelligence 12 IOCs YARA 28 File information Comments

SHA256 hash:	15e097cb7f04bed91a7502e9a11b1c1fd9498fcece521438c5b772a39ae531e9
SHA3-384 hash:	43537ff60ac900a602e8687e958a7db27224a4f59cdfb2566cab0fbf636a85a7d57004ad299396b694e97237336a849d
SHA1 hash:	b86ded17dcfb834f4e349251883b1aef9b74ac7e
MD5 hash:	b1d9bd792f1d02c14e787f8fd3e9d6f1
humanhash:	quebec-eleven-idaho-alpha
File name:	Licence_Version_Loader_patched.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	2'538'496 bytes
First seen:	2026-03-01 12:47:10 UTC
Last seen:	2026-03-01 13:31:14 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ebc247a77b4d4a804b261f97a1fd075c (49 x Vidar, 19 x Smoke Loader, 3 x Stealc)
ssdeep	49152:V772LjTr6vcDarzmHUdTT6/j7TvDlTyBUP:V7ofMXmS3OBL
Threatray	64 similar samples on MalwareBazaar
TLSH	T1F3C57C0B7DE51CE5C86E9376DCBA11827B31BC490B3223D31A6579782E736D09D7AB08
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	aachum
Tags:	de-pumped exe nonobody123-com Stealc

iamaachum

https://www.youtube.com/post/Ugkxo2geOa1z9aNiDiMpJE_e22s-NeZF6HUV => https://www.mediafire.com/file/av6w7qy02m5n46t/Lic%25D0%25B5nce.L%25D0%25BEad%25D0%25B5r%2528%25D0%25A0A%2524%2524.-_2025%2529.rar/file

Stealc C2: https://nonobody123.com/a85e9a98b9364c5d8f74.php

Intelligence

File Origin

# of uploads :

# of downloads :

150

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

Licence_Version_Loader_patched.exe

Verdict:

Malicious activity

Analysis date:

2026-03-01 12:48:54 UTC

Tags:

stealc stealer

Link:

https://app.any.run/tasks/7e106d3c-7f84-4443-bc28-9577f275af62

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/55094/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.34644757.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a43573c950ab5d9ab3021b

Tags:

injection cobalt obfusc small

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/15e097cb7f04bed91a7502e9a11b1c1fd9498fcece521438c5b772a39ae531e9

Verdict:

Malicious

File Type:

exe x64

Detections:

Trojan-PSW.Win64.StealC.gt Trojan.Win64.Agent.sb PDM:Trojan.Win32.Generic Trojan-PSW.Win64.StealC.sb

Link:

https://opentip.kaspersky.com/15e097cb7f04bed91a7502e9a11b1c1fd9498fcece521438c5b772a39ae531e9/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/51f17950-f17e-4ae8-9b5f-206545525086

Result

Threat name:

Stealc v2

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1876476

Signature

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Detected unpacking (creates a PE file in dynamic memory)

Early bird code injection technique detected

Found API chain indicative of debugger detection

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Potentially malicious time measurement code found

Queues an APC in another process (thread injection)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Unusual module load detection (module proxying)

Writes to foreign memory regions

Yara detected Stealc v2

Behaviour

Behavior Graph:

Download SVG

Score:

94%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/15e097cb7f04bed91a7502e9a11b1c1fd9498fcece521438c5b772a39ae531e9

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/b1d9bd792f1d02c14e787f8fd3e9d6f1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/15e097cb7f04bed91a7502e9a11b1c1fd9498fcece521438c5b772a39ae531e9/

Verdict:

Malicious

Threat:

Family.STEALC

Link:

https://tip.neiki.dev/file/15e097cb7f04bed91a7502e9a11b1c1fd9498fcece521438c5b772a39ae531e9

Threat name:

Win64.Trojan.Generic

Status:

Suspicious

First seen:

2026-03-01 12:48:32 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cxqjps37as7nsgtvalu2cgy4d7mutd6ozzjbiogfw5zkhgxfghuq._file

Verdict:

malicious

Label(s):

stealc

Stealc

2ec0617f5b338d415fb6d28744f68e0f19304e24860f7b77c180b09af10b3834

Stealc

3111fce31bbf05392b16fe620d01ce4c49661cde33682d2a8a277eefffca1c49

Stealc

46145eb01bb32c28d3550b307891336d531c3e5c4e2b6656f3d19f751cb4408d

Stealc

601dec97c0ada64009cd7de35966d976322470b185a64dbc45f22feb33a2dc63

Stealc

error

Stealc

+ 54 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/260301-p1a2tshv8c/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

15e097cb7f04bed91a7502e9a11b1c1fd9498fcece521438c5b772a39ae531e9

MD5 hash:

b1d9bd792f1d02c14e787f8fd3e9d6f1

SHA1 hash:

b86ded17dcfb834f4e349251883b1aef9b74ac7e

Link:

https://www.unpac.me/results/e583a70e-2f07-4576-a732-bc604f2df502/

Malware family:

Stealc.v2

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/15e097cb7f04/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Heuristics_ChromeABE Create hunting rule
Author:	Still
Description:	attempts to match instructions related to Chrome App-bound Encryption elevation service; possibly spotted amongst infostealers

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	StealcV2 Create hunting rule
Author:	Still
Description:	attempts to match the instructions found in StealcV2

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Windows_Trojan_Stealc_41db1d4d Create hunting rule
Author:	Elastic Security

Rule name:	win_stealc_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.stealc.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

rar 415c515f3b6b35f0ab3b186bd36789594be18651452bb5d93514e888435524dd

Stealc

exe 15e097cb7f04bed91a7502e9a11b1c1fd9498fcece521438c5b772a39ae531e9

(this sample)

Link

https://tria.ge/260301-psnb7ag17c/behavioral1

Dropped by

SHA256 415c515f3b6b35f0ab3b186bd36789594be18651452bb5d93514e888435524dd

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/55094/

Dropped by

MD5 13f6cb5126c94c91806e6c20741be950

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample