🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18a3606fc13b42fea63dea411d5f4be6522ebff0c14d7044bb60401bbe66bf25. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 10


Intelligence 10 IOCs 5 YARA 112 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18a3606fc13b42fea63dea411d5f4be6522ebff0c14d7044bb60401bbe66bf25
SHA3-384 hash: 06d7f7c00a5a6bf7280a677e9e0d829abe365d88662858ec0cd71a4bddf744dfab13c6cd73489846221248017732b46a
SHA1 hash: 287052608ba46666608d6289394ead5b3c74dc8b
MD5 hash: 59ce32c77819ade2010d988c76862dd1
humanhash: west-three-minnesota-seven
File name:18a3606fc13b42fea63dea411d5f4be6522ebff0c14d7044bb60401bbe66bf25.zip
Download: download sample
Signature Stealc
Create hunting rule
File size:19'286'234 bytes
First seen:2026-01-29 15:47:58 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 393216:31A7Yi8kjfY5n0GtP4kt/SXe74x4c0HyXaAypIwSZo:31A2krstAeUVJYYaAyCw3
TLSH T11017335CEA94AFB59CDDD74EAB21D94B511CEB488F59D8E1882603440CF6074CF2A8FB
Magika zip
Reporter JAMESWT_WT
Tags:45-93-20-55 Stealc zip

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://45.93.20.55/49dcd5e318c542c5.php https://threatfox.abuse.ch/ioc/1738107/
196.251.107.104:7707 https://threatfox.abuse.ch/ioc/1685210/
196.251.107.104:1912 https://threatfox.abuse.ch/ioc/1735376/
196.251.107.104:6606 https://threatfox.abuse.ch/ioc/1685209/
http://196.251.107.23/04ca1421433e0038.php https://threatfox.abuse.ch/ioc/1736007/

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
IT IT
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:Hotmail-Checker.exe
File size:22'219'264 bytes
SHA256 hash: 14ebace0658729a5e2cf930e7eaaa3e4ae22c91da411410951d78a38bd6beef6
MD5 hash: e0c485160c3f2bdcc8024c3843436e9f
MIME type:application/x-dosexec
Signature RedLineStealer
File name:hotmail.txt
File size:286'258 bytes
SHA256 hash: ad68bcc29dc21a0dfb408f2aff9f90fb0d9171461af9a409a30602d3e76ec06c
MD5 hash: 3646bb6388ad00f7db5b6e74d195b4d8
MIME type:text/plain
Signature Stealc
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/393f6a33-82e3-4b57-a789-43c3129019b9/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=697b81306fa3eed165304429
Tags:
autorun emotet
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/18a3606fc13b42fea63dea411d5f4be6522ebff0c14d7044bb60401bbe66bf25/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm crypt fingerprint meterpreter microsoft_visual_cc obfuscated packed soft-404 xpack
Link:
https://www.filescan.io/uploads/697b81532ffccda0976371c3/reports/983afee1-beac-449a-886c-13fc7fb82b6d/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/18a3606fc13b42fea63dea411d5f4be6522ebff0c14d7044bb60401bbe66bf25
Verdict:
Malicious
File Type:
zip
First seen:
2026-01-28T20:53:00Z UTC
Last seen:
2026-01-29T07:07:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/18a3606fc13b42fea63dea411d5f4be6522ebff0c14d7044bb60401bbe66bf25/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/18a3606fc13b42fea63dea411d5f4be6522ebff0c14d7044bb60401bbe66bf25
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18a3606fc13b42fea63dea411d5f4be6522ebff0c14d7044bb60401bbe66bf25/
Threat name:
Win64.Trojan.SvcStealer
Create hunting rule
Status:
Malicious
First seen:
2026-01-29 01:48:59 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
15 of 23 (65.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dcrwa36bhnbp5jr55jar2x2l4zjc5p7qyfgxarf3mbabxptgx4sq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/18a3606fc13b42fea63dea411d5f4be6522ebff0c14d7044bb60401bbe66bf25

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AsyncRat
Create hunting rule
Author:kevoreilly, JPCERT/CC Incident Response Group
Description:AsyncRat Payload
Rule name:asyncrat_kingrat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Check_Dlls
Create hunting rule
Rule name:cobalt_strike_beacon_detected
Create hunting rule
Author:0x0d4y
Description:This rule detects cobalt strike beacons.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:CSharpRat
Create hunting rule
Description:CSharpRat hunter
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:detect_Redline_Stealer_V2
Create hunting rule
Author:Varp0s
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:GenericRedLineLike
Create hunting rule
Author:Still
Description:Matches RedLine-like stealer; may match its variants.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:grakate_stealer_nov_2021
Create hunting rule
Rule name:HeavensGate
Create hunting rule
Author:kevoreilly
Description:Heaven's Gate: Switch from 32-bit to 64-mode
Rule name:Heuristics_ChromeABE
Create hunting rule
Author:Still
Description:attempts to match instructions related to Chrome App-bound Encryption elevation service; possibly spotted amongst infostealers
Rule name:HKTL_Meterpreter_inMemory
Create hunting rule
Author:netbiosX, Florian Roth
Description:Detects Meterpreter in-memory
Reference:https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
Create hunting rule
Author:ditekSHen
Description:Detects file containing reversed ASEP Autorun registry keys
Rule name:INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL
Create hunting rule
Author:ditekSHen
Description:Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Rule name:INDICATOR_SUSPICIOUS_References_SecTools
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many IR and analysis tools
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:Detects Reflective DLL injection artifacts
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:malware_asyncrat
Create hunting rule
Description:detect AsyncRat in memory
Reference:https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MALWARE_Win_MetaStealer
Create hunting rule
Author:ditekSHen
Description:Detects MetaStealer infostealer
Rule name:MAL_AsnycRAT
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:MAL_AsyncRAT_Config_Decryption
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects AsnycRAT based on it's config decryption routine
Rule name:MAL_packer_lb_was_detected
Create hunting rule
Author:0x0d4y
Description:Detect the packer used by Lockbit4.0
Rule name:Mal_WIN_AsyncRat_RAT_PE
Create hunting rule
Author:Phatcharadol Thangplub
Description:Use to detect AsyncRAT implant.
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:msil_suspicious_use_of_strreverse
Create hunting rule
Author:dr4k0nia
Description:Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse
Rule name:Multifamily_RAT_Detection
Create hunting rule
Author:Lucas Acha (http://www.lukeacha.com)
Description:Generic Detection for multiple RAT families, PUPs, Packers and suspicious executables
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:Njrat
Create hunting rule
Author:botherder https://github.com/botherder
Description:Njrat
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:redline_stealer_1
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:RedLine Stealer Payload
Rule name:RedLine_Stealer_unpacked_PulseIntel
Create hunting rule
Author:PulseIntel
Description:Detecting unpacked Redline
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:StealcV2
Create hunting rule
Author:kevoreilly
Description:Stealc V2 Payload
Rule name:StealcV2
Create hunting rule
Author:Still
Description:attempts to match the instructions found in StealcV2
Rule name:SUSP_DOTNET_PE_List_AV
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detecs .NET Binary that lists installed AVs
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:win32_async_rat
Create hunting rule
Author:Reedus0
Description:Rule for detecting AsyncRAT malware
Rule name:win32_dotnet_form_obfuscate
Create hunting rule
Author:Reedus0
Description:Rule for detecting .NET form obfuscate malware
Rule name:win32_redline_stealer
Create hunting rule
Author:Reedus0
Description:Rule for detecting RedLine Stealer malware
Rule name:Windows_Generic_Threat_c9003b7b
Create hunting rule
Author:Elastic Security
Rule name:Windows_Generic_Threat_ce98c4bc
Create hunting rule
Author:Elastic Security
Rule name:Windows_Generic_Threat_efdb9e81
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Asyncrat_11a11ba1
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Generic_40899c85
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_RedLineStealer_6dfafd7b
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Stealc_41db1d4d
Create hunting rule
Author:Elastic Security
Rule name:win_asyncrat_bytecodes
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects bytecodes present in unobfuscated AsyncRat Samples. Rule may also pick up on other Asyncrat-derived malware (Dcrat/venom etc)
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_asyncrat_unobfuscated
Create hunting rule
Author:Matthew @ Embee_Research
Description:Detects strings present in unobfuscated AsyncRat Samples. Rule may also pick up on other Asyncrat-derived malware (Dcrat/venom etc)
Rule name:win_asyncrat_w0
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect AsyncRat in memory
Reference:internal research
Rule name:win_redline_stealer_generic
Create hunting rule
Author:dubfib
Rule name:win_stealer_generic
Create hunting rule
Author:Reedus0
Description:Rule for detecting generic stealer malware
Rule name:win_tinynuke_g0
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:XTinyLoader
Create hunting rule
Author:Nikos 'n0t' Totosis
Description:Detects XTiny Loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments