MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 16

Intelligence 16 IOCs YARA 11 File information Comments 1

SHA256 hash:	1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f
SHA3-384 hash:	65d90cf96df10c8496b9873c3a2c437cc0dab12a7c07a8ba7a34cccbc8bfd6f18685ccc10fa873c48b8c101e15bbbae9
SHA1 hash:	9ac38a6f5a9e77b724f4df58ad54ac5d90183e15
MD5 hash:	ca4c78e5b146a4eddfcde39610ff1943
humanhash:	ack-robert-nuts-bacon
File name:	ca4c78e5b146a4eddfcde39610ff1943
Download:	download sample
Signature	Stealc Create hunting rule
File size:	305'152 bytes
First seen:	2024-04-26 09:59:52 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fee2e01e9ecb27c28da2b6fc37f265e9 (4 x Stealc, 1 x RedLineStealer)
ssdeep	3072:1HdB+Q00pIdkl+P0VD8Df5h8jYbSE7XGKICg6hty92rN3G9JlCUj6+PhXmSIN8nj:pNySl68srjg6/529PCUj6Gch8nPr
TLSH	T1D5545A0736E47C90E62247724F2EBAEC372DF9649F556B3722586F0B84702B0D263B56
TrID	60.4% (.EXE) InstallShield setup (43053/19/16) 14.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	1012200211880400 (1 x Stealc)
Reporter	zbetcheckin
Tags:	32 exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

489

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f.exe

Verdict:

Malicious activity

Analysis date:

2024-04-26 10:03:13 UTC

Tags:

stealer stealc

Link:

https://app.any.run/tasks/c2ce4d01-82cf-4ab2-ac1f-fe7924a1a4b5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Connection attempt to an infection source

Sending an HTTP GET request to an infection source

Verdict:

No Threat

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint

Link:

https://www.filescan.io/uploads/662b7b2354bafb7d21deb033/reports/68555da5-2e53-4a2b-8df4-737230c7e2eb/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/785be52c-da35-4a47-83d8-599f9c32f5de

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1432079

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f/

Threat name:

Win32.Spyware.Stealc

Status:

Malicious

First seen:

2024-04-26 10:00:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=dq2ern4fiz4gzur3azbhadtmaw2jy6dpdo7s6fggbt77fm3yonxq._file

Verdict:

malicious

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc stealer

Link:

https://tria.ge/reports/240426-l1mtvaea25/

Behaviour

Program crash

Stealc

Unpacked files

SH256 hash:

743875dcc496b10bc3b30df93f050fc7660b19a0125046769fcb5eb9166d62b9

MD5 hash:

3d508dd52445d80003ea8f82924983ed

SHA1 hash:

87573bf07f77149fd531082018f784992b183795

Detections:

stealc

win_stealc_auto

Link:

https://www.unpac.me/results/7b49a1c3-a2ca-4cd6-b2f7-0e7b139197ff/

Parent samples :

1a102b793f4cad2e1bffc0a7e25ffd3601744a616d19f7f5dbd57c8a116538b3
9bef7a636bd52f5ecd74c1f4041c73eefad5e23f8a978af0201f72cd24a9b0d0
fb63921ce0bda58d6277755b5e784e7b042f646d64ebbd230a6b9b8ab3db33d7
a4805aa4e8b2cb5956f757d210eaa3cd8d14b9f882f483473b1c5cc9c64c441d
1418981255cd087e37c0995615e09d0e969a1adafc29f7995156e0b1d4c40285
6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891
d5dbffe347a31cc50559e0c91f94f47fa1f134d3678c7721685af1bdf84be133
2daf90fbe9e99b9e0378f48a8b091fa703b735760ebf32ce609b40d4648a955e
8d8e0734ba1d608ef6ee124b1d5ab196223f6eb1d50348d1eb0b6ae57cd8ad3a
4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae
0a6e0a8505b349359dc63cc92fc46f879f19f43c246eb7e2445dcaca526d70fb
4d8b8c49b376c483e08d172646b49baf697d54b815b8357008117fed39c92cb0
c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0
cb664fc08a69a03e1d7ad2d47b9d7397330601fcfd8d559149ee606d782f14ad
dadc6e78d7628c9b004c60834d4f20729bf6718b972c31ef08c3bb7181a39a7f
6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8
a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3
1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f

SH256 hash:

1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f

MD5 hash:

ca4c78e5b146a4eddfcde39610ff1943

SHA1 hash:

9ac38a6f5a9e77b724f4df58ad54ac5d90183e15

Link:

https://www.unpac.me/results/7b49a1c3-a2ca-4cd6-b2f7-0e7b139197ff/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1c3448b78546/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Mars_Stealer Create hunting rule
Author:	@malgamy12
Description:	detect_Mars_Stealer

Rule name:	infostealer_win_stealc_standalone Create hunting rule
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	malware_Stealc_str Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	Stealc infostealer

Rule name:	Windows_Trojan_Generic_2993e5a5 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Stealc_b8ab9ab5 Create hunting rule
Author:	Elastic Security

Rule name:	win_stealc_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.stealc.

Rule name:	win_stealc_w0 Create hunting rule
Author:	crep1x
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2754939/

URLhaus

https://urlhaus.abuse.ch/url/2810818/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetVolumeInformationW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleInputA KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleAliasesA KERNEL32.dll::GetConsoleProcessList KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateHardLinkA KERNEL32.dll::CreateFileW KERNEL32.dll::GetWindowsDirectoryA KERNEL32.dll::RemoveDirectoryA KERNEL32.dll::GetTempPathA
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-04-26 09:59:53 UTC

url : hxxp://185.172.128.127/timeSync.exe