MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1989b578e9207004dba31c1fe03a075d21754f68f3bb43630783f75735e9f33c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 15

Intelligence 15 IOCs YARA 8 File information Comments

SHA256 hash:	1989b578e9207004dba31c1fe03a075d21754f68f3bb43630783f75735e9f33c
SHA3-384 hash:	dc1d024a3a1558433dd5a93cf55783792f8dbc6ad4b842619686d1f206c5e201e7d62afed01d93b40fde19eff72fc83a
SHA1 hash:	3c6263acc11f5223d77cf3fd7c65cd53a8c8f124
MD5 hash:	583818cc15e2b69121f5944f97ed1d4f
humanhash:	timing-xray-bulldog-earth
File name:	583818cc15e2b69121f5944f97ed1d4f.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	196'096 bytes
First seen:	2023-04-07 13:20:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	71666ce513898b08ba38dfa1dc35ec76 (3 x Stop, 2 x Smoke Loader, 2 x Rhadamanthys)
ssdeep	3072:uLEr7e5jfxb/WVntV2sHK8yPmI7mL3QVjVJteT45DfI//iO1TIx:8R5jdEtEsqn+oJYKsPT
Threatray	189 similar samples on MalwareBazaar
TLSH	T1EE14BE11BDDDC8B3D45785304825C2F4767ABC63DB419A8B33686F6B7C31E826A76312
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	008ace8020603000 (1 x Stealc)
Reporter	abuse_ch
Tags:	exe Stealc

abuse_ch

Stealc C2:
http://65.108.20.233/18e7847188a1b7bd.php

Intelligence

File Origin

# of uploads :

# of downloads :

258

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

583818cc15e2b69121f5944f97ed1d4f.exe

Verdict:

Malicious activity

Analysis date:

2023-04-07 13:21:27 UTC

Tags:

stealer loader

Link:

https://app.any.run/tasks/b6895d2a-8886-47db-90b5-b41de0394ef8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/380785/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP GET request

Creating a file

Reading critical registry keys

Changing a file

Creating a file in the %AppData% subdirectories

Creating a window

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Stealing user critical data

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/76899/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

CPUID_Instruction

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/643018c0da5bf6666c9d0ca1/reports/9c29e80f-9cef-4659-a0e5-6a14eaf3813b/overview

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/1989b578e9207004dba31c1fe03a075d21754f68f3bb43630783f75735e9f33c

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2f9205a0-6e6e-4e8c-bd0c-c245aa4f1cc1

Result

Threat name:

Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1210213

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1989b578e9207004dba31c1fe03a075d21754f68f3bb43630783f75735e9f33c/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2023-04-07 13:21:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=dge3k6hjebyajw5ddqp6aoqhluqxkt3i6o5ugyyhqp3vonpj6m6a._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/230407-qlmyhsbb3v/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Unpacked files

SH256 hash:

adabc4e7ea0e39a5120422cc685c14dbed42712f3a4a6dd6a97acb8682bff064

MD5 hash:

b5f9229cba89dccb0ffd84c83a2f65c2

SHA1 hash:

857e6bd2556e55a6f7eb085b28b27b85d9e184bb

Detections:

win_stealc_auto

win_stealc_a0

Link:

https://www.unpac.me/results/8032f8f4-c92e-482f-9bae-6d9eaa280f7d/

SH256 hash:

1989b578e9207004dba31c1fe03a075d21754f68f3bb43630783f75735e9f33c

MD5 hash:

583818cc15e2b69121f5944f97ed1d4f

SHA1 hash:

3c6263acc11f5223d77cf3fd7c65cd53a8c8f124

Link:

https://www.unpac.me/results/8032f8f4-c92e-482f-9bae-6d9eaa280f7d/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1989b578e920/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1989b578e9207004dba31c1fe03a075d21754f68f3bb43630783f75735e9f33c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers

Rule name:	infostealer_win_stealc_standalone Create hunting rule
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	pdb_YARAify Create hunting rule
Author:	@wowabiy314
Description:	PDB

Rule name:	Vidar Create hunting rule
Author:	kevoreilly,rony
Description:	Vidar Payload

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	win_stealc_w0 Create hunting rule
Author:	crep1x
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	yara_template Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/380785/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample