MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c6bb4115d8b51391fd600bc70d88a8e9cc9e6406cd7f626087ff4cead341784. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 15


Intelligence 15 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1c6bb4115d8b51391fd600bc70d88a8e9cc9e6406cd7f626087ff4cead341784
SHA3-384 hash: c0828c7fb172af4b1ac9671fb2facd793e09711c3c4a4e1ca3ffb5fe20014a509943a9ad26504065f577c98b0ab55ba0
SHA1 hash: 8c94b577b260a9a1606af373ee25ab65478d797d
MD5 hash: 6781c522f3390cc4947959d168e61bbc
humanhash: juliet-tango-neptune-five
File name:file
Download: download sample
Signature Stealc
Create hunting rule
File size:50'907 bytes
First seen:2024-04-26 09:04:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f4639a0b3116c2cfc71144b88a929cfd (96 x GuLoader, 53 x Formbook, 37 x VIPKeylogger)
ssdeep 1536:XferrLkSRoe8C4UZsys0Dh1duFpmFI+PlU:Xfi3k+oWDBDh1duFpbWlU
TLSH T13533BF11E7A0C077D9F2037228363BA75FFA952616E45B0743502F5D7CA3A82E91F7A2
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter Bitsight
Tags:exe Stealc


Avatar
Bitsight
url: https://vk.com/doc5294803_668993960?hash=Z9lhrsLMzuV1XJuhY4zQtzdaRRwzQtC4a9AWZl2tz3H&dl=3URmyiP5qkSf8z8w5ffO4nMwnjcUXSBiz8mtD9wpScT&api=1&no_preview=1#ld

Intelligence

File Origin
# of uploads :
1
# of downloads :
311
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1c6bb4115d8b51391fd600bc70d88a8e9cc9e6406cd7f626087ff4cead341784.exe
Verdict:
Malicious activity
Analysis date:
2024-04-26 09:05:11 UTC
Tags:
loader adware innosetup gcleaner
Link:
https://app.any.run/tasks/4a79994a-b8b3-4dfd-8737-8e853583bd7e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Running batch commands
Сreating synchronization primitives
Creating a file
Creating a process from a recently created file
Launching a process
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Creating a file in the %AppData% subdirectories
Launching cmd.exe command interpreter
Searching for synchronization primitives
Downloading the file
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/662b6e3fd2fc149e411f04ba/reports/5099a9ba-5570-4c91-94b8-0cdb6a3339ae/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/1c6bb4115d8b51391fd600bc70d88a8e9cc9e6406cd7f626087ff4cead341784
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b5a4e1a1-5a4a-4a4b-b9a1-74ff5f97a51a
Result
Threat name:
Mars Stealer, PureLog Stealer, RedLine,
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1432050
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks if the current machine is a virtual machine (disk enumeration)
Creates files in the recycle bin to hide itself
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking locale)
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies Group Policy settings
Modifies Windows Defender protection settings
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Powershell drops PE file
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell DownloadFile
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Set custom UserAgent and download file via Powershell
Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder
Snort IDS alert for network traffic
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses cmd line tools excessively to alter registry or file data
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected Mars stealer
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected Stealc
Yara detected UAC Bypass using CMSTP
Yara detected Vidar stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1432050 Sample: file.exe Startdate: 26/04/2024 Architecture: WINDOWS Score: 100 189 c.574859385.xyz 2->189 191 www.rapidfilestorage.com 2->191 193 11 other IPs or domains 2->193 235 Snort IDS alert for network traffic 2->235 237 Multi AV Scanner detection for domain / URL 2->237 239 Found malware configuration 2->239 243 22 other signatures 2->243 15 file.exe 25 2->15         started        19 Install.exe 2->19         started        22 svchost.exe 2->22         started        signatures3 241 Performs DNS queries to domains with low reputation 189->241 process4 dnsIp5 207 dsepc5ud74wta.cloudfront.net 13.249.105.199, 443, 49704, 49705 AMAZON-02US United States 15->207 139 C:\Users\user\AppData\Local\...\INetC.dll, PE32 15->139 dropped 141 C:\Users\user\AppData\Local\Temp\...\load.bat, DOS 15->141 dropped 24 cmd.exe 1 1 15->24         started        143 C:\Windows\Temp\...\ySPgHoN.exe, PE32 19->143 dropped 145 C:\Windows\System32behaviorgraphroupPolicy\gpt.ini, ASCII 19->145 dropped 245 Creates files in the recycle bin to hide itself 19->245 247 Modifies Windows Defender protection settings 19->247 249 Modifies Group Policy settings 19->249 27 cmd.exe 19->27         started        209 iolo0.b-cdn.net 195.181.163.196 CDN77GB United Kingdom 22->209 211 127.0.0.1 unknown unknown 22->211 147 SystemMechanic_548...38868BD1.exe (copy), PE32 22->147 dropped 149 C:\Users\user\AppData\Local\...\BIT3C1E.tmp, PE32 22->149 dropped 251 Benign windows process drops PE files 22->251 file6 signatures7 process8 signatures9 259 Suspicious powershell command line found 24->259 261 Uses cmd line tools excessively to alter registry or file data 24->261 263 Tries to download and execute files (via powershell) 24->263 265 Found hidden mapped module (file has been removed from disk) 24->265 29 i1.exe 3 11 24->29         started        34 i3.exe 24->34         started        36 powershell.exe 15 16 24->36         started        44 4 other processes 24->44 267 Modifies Windows Defender protection settings 27->267 38 forfiles.exe 27->38         started        40 forfiles.exe 27->40         started        42 forfiles.exe 27->42         started        46 2 other processes 27->46 process10 dnsIp11 195 185.172.128.90, 49708, 80 NADYMSS-ASRU Russian Federation 29->195 197 185.172.128.228, 49710, 80 NADYMSS-ASRU Russian Federation 29->197 199 note.padd.cn.com 176.97.76.106, 49713, 80 INTRAFFIC-ASUA United Kingdom 29->199 165 C:\Users\user\AppData\Local\Temp\u5do.3.exe, PE32 29->165 dropped 167 C:\Users\user\AppData\Local\Temp\...\run.exe, PE32 29->167 dropped 169 C:\Users\user\AppData\Local\...\relay.dll, PE32 29->169 dropped 179 2 other malicious files 29->179 dropped 277 Detected unpacking (overwrites its own PE header) 29->277 48 u5do.0.exe 79 29->48         started        53 run.exe 29->53         started        55 u5do.3.exe 29->55         started        57 WerFault.exe 29->57         started        171 C:\Users\user\AppData\Local\...\notepad.exe, PE32+ 34->171 dropped 173 C:\Users\user\AppData\...\browser_broker.exe, PE32+ 34->173 dropped 181 2 other malicious files 34->181 dropped 59 Install.exe 34->59         started        279 Powershell drops PE file 36->279 281 Modifies Windows Defender protection settings 38->281 61 cmd.exe 38->61         started        63 cmd.exe 40->63         started        65 cmd.exe 42->65         started        201 c.574859385.xyz 37.221.125.202 PTSERVIDORPT Lithuania 44->201 203 185.172.128.59, 49707, 49711, 80 NADYMSS-ASRU Russian Federation 44->203 205 monoblocked.com 45.130.41.108, 443, 49715 BEGET-ASRU Russian Federation 44->205 175 C:\Users\user\AppData\Local\Temp\i3.exe, PE32 44->175 dropped 177 C:\Users\user\AppData\Local\Temp\i1.exe, PE32 44->177 dropped 283 Found many strings related to Crypto-Wallets (likely being stolen) 44->283 285 Uses cmd line tools excessively to alter registry or file data 44->285 67 cmd.exe 46->67         started        file12 signatures13 process14 dnsIp15 183 185.172.128.76, 49712, 80 NADYMSS-ASRU Russian Federation 48->183 185 185.172.128.203 NADYMSS-ASRU Russian Federation 48->185 151 C:\Users\user\AppData\...\JKJKJJDBKE.exe, PE32 48->151 dropped 153 C:\Users\user\AppData\Local\...\tiktok[1].exe, PE32 48->153 dropped 155 C:\Users\user\AppData\...\softokn3[1].dll, PE32 48->155 dropped 161 11 other files (7 malicious) 48->161 dropped 213 Detected unpacking (changes PE section rights) 48->213 215 Detected unpacking (overwrites its own PE header) 48->215 217 Tries to steal Mail credentials (via file / registry access) 48->217 233 7 other signatures 48->233 157 C:\Users\user\AppData\Roaming\...\relay.dll, PE32 53->157 dropped 159 C:\Users\user\AppData\...\UIxMarketPlugin.dll, PE32 53->159 dropped 219 Maps a DLL or memory area into another process 53->219 221 Found direct / indirect Syscall (likely to bypass EDR) 53->221 69 cmd.exe 53->69         started        187 svc.iolo.com 20.157.87.45 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 55->187 223 Checks if the current machine is a virtual machine (disk enumeration) 55->223 225 Machine Learning detection for dropped file 59->225 227 Uses schtasks.exe or at.exe to add and modify task schedules 59->227 229 Modifies Windows Defender protection settings 59->229 73 cmd.exe 59->73         started        75 forfiles.exe 59->75         started        77 forfiles.exe 59->77         started        79 schtasks.exe 59->79         started        231 Uses cmd line tools excessively to alter registry or file data 61->231 81 reg.exe 61->81         started        83 reg.exe 63->83         started        85 reg.exe 65->85         started        87 reg.exe 67->87         started        file16 signatures17 process18 file19 163 C:\Users\user\AppData\Local\Temp\hmgv, PE32 69->163 dropped 253 Writes to foreign memory regions 69->253 255 Maps a DLL or memory area into another process 69->255 89 conhost.exe 69->89         started        257 Modifies Windows Defender protection settings 73->257 91 forfiles.exe 73->91         started        94 forfiles.exe 73->94         started        96 forfiles.exe 73->96         started        104 3 other processes 73->104 98 cmd.exe 75->98         started        100 conhost.exe 75->100         started        106 2 other processes 77->106 102 conhost.exe 79->102         started        signatures20 process21 signatures22 269 Modifies Windows Defender protection settings 91->269 108 cmd.exe 91->108         started        111 cmd.exe 94->111         started        113 cmd.exe 96->113         started        271 Suspicious powershell command line found 98->271 115 powershell.exe 98->115         started        117 cmd.exe 104->117         started        119 cmd.exe 104->119         started        121 schtasks.exe 106->121         started        process23 signatures24 273 Uses cmd line tools excessively to alter registry or file data 108->273 123 reg.exe 108->123         started        125 reg.exe 111->125         started        127 reg.exe 113->127         started        129 WMIC.exe 115->129         started        275 Suspicious powershell command line found 117->275 131 powershell.exe 117->131         started        133 reg.exe 119->133         started        process25 process26 135 gpupdate.exe 131->135         started        process27 137 conhost.exe 135->137         started       
Score:
85%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1c6bb4115d8b51391fd600bc70d88a8e9cc9e6406cd7f626087ff4cead341784
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1c6bb4115d8b51391fd600bc70d88a8e9cc9e6406cd7f626087ff4cead341784/
Threat name:
Win32.Trojan.PrivateLoader
Create hunting rule
Status:
Malicious
First seen:
2024-04-25 16:44:16 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=drv3iek5rnitsh6wac6hbwekr2omtzsantl7mjqip72m5ljuc6ca._file
Verdict:
malicious
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:sectoprat family:stealc discovery rat spyware stealer trojan
Link:
https://tria.ge/reports/240426-k16raadb88/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Checks installed software on the system
Drops Chrome extension
Drops desktop.ini file(s)
Legitimate hosting services abused for malware hosting/C2
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
SectopRAT
SectopRAT payload
Stealc
Malware Config
Dropper Extraction:
https://dsepc5ud74wta.cloudfront.net/load/th.php?c=1000
https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=425&c=1000
https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=444
https://dsepc5ud74wta.cloudfront.net/load/dl.php?id=456
Unpacked files
SH256 hash:
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
MD5 hash:
40d7eca32b2f4d29db98715dd45bfac5
SHA1 hash:
124df3f617f562e46095776454e1c0c7bb791cc7
Link:
https://www.unpac.me/results/81a629dd-a4c0-4801-89cd-87b648f7f32b/
SH256 hash:
1c6bb4115d8b51391fd600bc70d88a8e9cc9e6406cd7f626087ff4cead341784
MD5 hash:
6781c522f3390cc4947959d168e61bbc
SHA1 hash:
8c94b577b260a9a1606af373ee25ab65478d797d
Link:
https://www.unpac.me/results/81a629dd-a4c0-4801-89cd-87b648f7f32b/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1c6bb4115d8b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1c6bb4115d8b51391fd600bc70d88a8e9cc9e6406cd7f626087ff4cead341784

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NSIS_April_2024
Create hunting rule
Author:NDA0N
Description:Detects NSIS installers
Rule name:Windows_Trojan_Generic_2993e5a5
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 1c6bb4115d8b51391fd600bc70d88a8e9cc9e6406cd7f626087ff4cead341784

(this sample)

  
Dropped by
Privateloader
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetDiskFreeSpaceW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::MoveFileExW
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::EmptyClipboard
USER32.dll::FindWindowExW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW
USER32.dll::CreateWindowExW

Comments