🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1dbb77aaaa897dca1ca3f911d6570df5c4bf9b2cafb88d2be8342fe032fb4ebb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 17


Intelligence 17 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1dbb77aaaa897dca1ca3f911d6570df5c4bf9b2cafb88d2be8342fe032fb4ebb
SHA3-384 hash: 93ebeac6111b98a716eba037325866856977e3d3d100ee88fd60f3f94f3f1c57cd22fcf61ebb36374174525fd94706e4
SHA1 hash: ad342f1b7439453c4ec459e00d33d813dcaa8014
MD5 hash: 6c0b293ef533afcffb3d34bc47f1971c
humanhash: violet-cup-louisiana-dakota
File name:Chaos Solution.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:6'693'768 bytes
First seen:2025-09-22 18:41:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash dc4152fd8ffd9d76d82af552da62e323 (8 x Stealc)
ssdeep 98304:MeRtUtk4ou2cdZdxsToXuikHehKxb/v9eH+GMC5iMbl7MZdzwy5YQY+L+1qp3VTQ:tvf8QoT10Z/v2lEMxab5DOl
TLSH T1E86612451B8AC0A5EAD07A303EDAC5FAF3F96DD848488CA89AF0F447A47DD337025759
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon f0c4b2f0f0b2d4f0 (2 x Rhadamanthys, 1 x AsyncRAT, 1 x Stealc)
Reporter aachum
Tags:178-16-54-175 exe Stealc


Avatar
iamaachum
https://sites.google.com/view/chaos-solution/home => https://www.mediafire.com/folder/smecxw594d9w1/Fortnite_Hack

Stealc C2: http://178.16.54.175/e9762ff07e084dbb.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://www.youtube.com/watch?v=tLL1quUp38E
Verdict:
Malicious activity
Analysis date:
2025-09-22 10:56:54 UTC
Tags:
stealc stealer loader themida
Link:
https://app.any.run/tasks/ab745947-7e41-42de-b4c1-b9a66eb1dfe8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Stealc
Create hunting rule
Link:
https://www.capesandbox.com/analysis/28591/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d198936c66b7ab69384330
Tags:
vmprotect vmdetect
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending an HTTP POST request to an infection source
Sending a custom TCP request
Connection attempt to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fingerprint invalid-signature obfuscated packed packed packer_detected signed threat
Link:
https://www.filescan.io/uploads/68d19a1473af424b47eaa581/reports/7e11cf84-0116-4eb1-bb3e-abcf2c6c3dd6/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/1dbb77aaaa897dca1ca3f911d6570df5c4bf9b2cafb88d2be8342fe032fb4ebb
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-09-22T00:32:00Z UTC
Last seen:
2025-09-22T00:32:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/1dbb77aaaa897dca1ca3f911d6570df5c4bf9b2cafb88d2be8342fe032fb4ebb/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/416e36be-c97b-4f0d-a68d-09be7e20c2a1
Result
Threat name:
Clipboard Hijacker, Stealc v2, Xmrig
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1782236
Signature
Adds a directory exclusion to Windows Defender
AI detected suspicious PE digital signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Connects to a pastebin service (likely for C&C)
Deletes shadow drive data (may be related to ransomware)
Disable Windows Defender notifications (registry)
Drops PE files to the document folder of the user
Drops PE files with benign system names
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Modifies power options to not sleep / hibernate
Modifies windows update settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Self deletion via cmd or bat file
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Schedule system process
Sigma detected: Stop EventLog
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Clipboard Hijacker
Yara detected Stealc v2
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1782236 Sample: Chaos Solution.exe Startdate: 22/09/2025 Architecture: WINDOWS Score: 100 83 pastebin.com 2->83 85 bmw4i428.su 2->85 97 Found malware configuration 2->97 99 Antivirus detection for URL or domain 2->99 101 Antivirus detection for dropped file 2->101 105 17 other signatures 2->105 10 Chaos Solution.exe 24 2->10         started        15 svchost.exe 2->15         started        17 svchost.exe 1 1 2->17         started        19 5 other processes 2->19 signatures3 103 Connects to a pastebin service (likely for C&C) 83->103 process4 dnsIp5 87 178.16.54.175, 49687, 80 DUSNET-ASDE Germany 10->87 89 178.16.53.193, 49697, 80 DUSNET-ASDE Germany 10->89 75 C:\Users\user\Documents\DgtyRbTA0qqM.exe, PE32+ 10->75 dropped 77 C:\Users\user\Documents\6c590oq1bM3D.exe, PE32+ 10->77 dropped 79 YEr2KP0jEBhSDdVcS9...AdHgmKyw7FZq[1].exe, PE32+ 10->79 dropped 81 mr5jFfcvZvZar7iVto...38Ox6k48cqPT[1].exe, PE32+ 10->81 dropped 121 Found many strings related to Crypto-Wallets (likely being stolen) 10->121 123 Self deletion via cmd or bat file 10->123 125 Tries to harvest and steal browser information (history, passwords, etc) 10->125 129 5 other signatures 10->129 21 DgtyRbTA0qqM.exe 9 2 10->21         started        25 6c590oq1bM3D.exe 23 10->25         started        27 cmd.exe 10->27         started        29 3 other processes 10->29 127 Changes security center settings (notifications, updates, antivirus, firewall) 15->127 91 127.0.0.1 unknown unknown 17->91 file6 signatures7 process8 file9 71 C:\ProgramData\Microsoft\...\WmiPrvSE.exe, PE32+ 21->71 dropped 107 Antivirus detection for dropped file 21->107 109 Multi AV Scanner detection for dropped file 21->109 111 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 21->111 119 6 other signatures 21->119 31 cmd.exe 1 21->31         started        34 cmd.exe 21->34         started        36 powershell.exe 23 21->36         started        48 15 other processes 21->48 73 C:\Users\user\AppData\Roaming\...\svchost.exe, PE32+ 25->73 dropped 113 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 25->113 115 Queries memory information (via WMI often done to detect virtual machines) 25->115 117 Drops PE files with benign system names 25->117 38 cmd.exe 25->38         started        40 cmd.exe 25->40         started        42 cmd.exe 25->42         started        44 conhost.exe 27->44         started        46 timeout.exe 27->46         started        signatures10 process11 signatures12 131 Uses ping.exe to sleep 31->131 133 Uses schtasks.exe or at.exe to add and modify task schedules 31->133 135 Uses powercfg.exe to modify the power settings 31->135 137 Uses ping.exe to check the status of other devices and networks 31->137 50 conhost.exe 31->50         started        53 net.exe 1 31->53         started        139 Modifies power options to not sleep / hibernate 34->139 59 7 other processes 34->59 141 Loading BitLocker PowerShell Module 36->141 55 WmiPrvSE.exe 36->55         started        57 conhost.exe 36->57         started        61 2 other processes 38->61 63 2 other processes 40->63 65 2 other processes 42->65 67 17 other processes 48->67 process13 signatures14 93 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 50->93 95 Queries memory information (via WMI often done to detect virtual machines) 50->95 69 net1.exe 1 53->69         started        process15
Score:
78%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1dbb77aaaa897dca1ca3f911d6570df5c4bf9b2cafb88d2be8342fe032fb4ebb
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/6c0b293ef533afcffb3d34bc47f1971c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1dbb77aaaa897dca1ca3f911d6570df5c4bf9b2cafb88d2be8342fe032fb4ebb/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-09-22 18:55:42 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
25 of 38 (65.79%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dw5xpkvkrf64uhfd7ei5mvyn6xcl7gzmv64i2k7igqx6amx3j25q._file
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:for4dexine defense_evasion discovery spyware stealer themida trojan
Link:
https://tria.ge/reports/250922-xcnxsatjw7/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Stealc
Stealc family
Malware Config
C2 Extraction:
http://178.16.54.175
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/093e0cbd-08e3-4c52-9464-bb463bb61f98
Unpacked files
SH256 hash:
1dbb77aaaa897dca1ca3f911d6570df5c4bf9b2cafb88d2be8342fe032fb4ebb
MD5 hash:
6c0b293ef533afcffb3d34bc47f1971c
SHA1 hash:
ad342f1b7439453c4ec459e00d33d813dcaa8014
Link:
https://www.unpac.me/results/3a1a095c-9ffb-471a-ab15-f243bc37e4be/
SH256 hash:
65fb7891f64b4ea3a1c446d48cbf46467e22520f43cff79d0dc6c5ce070dc3b2
MD5 hash:
d53ec7efe26342f6543d6cb3acd47d91
SHA1 hash:
20b07b05e5912eaecf4a30900b792e5f4924eee5
Detections:
stealc
Create hunting rule
Link:
https://www.unpac.me/results/3a1a095c-9ffb-471a-ab15-f243bc37e4be/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1dbb77aaaa89/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1dbb77aaaa897dca1ca3f911d6570df5c4bf9b2cafb88d2be8342fe032fb4ebb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 1dbb77aaaa897dca1ca3f911d6570df5c4bf9b2cafb88d2be8342fe032fb4ebb

(this sample)

  
Link
https://tria.ge/250922-w75ckssry2/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/28591/

Comments