MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f27ad0379e176ab51f8adaf154e0172dcdd11c2d4f09dd84c89f036f7a55199. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f27ad0379e176ab51f8adaf154e0172dcdd11c2d4f09dd84c89f036f7a55199
SHA3-384 hash: eb34463030bfdd8b878c09b0f1bd043e0c9d084aa384fe25c0f74de16fed4905723a3e14618cd2c40cd9f7221a6b91f9
SHA1 hash: e59dea08b60c0a67ccb135c2521e4d16631a904f
MD5 hash: 53ce3c478fcfafc89749ac3b6eec69bf
humanhash: stairway-march-princess-network
File name:53ce3c478fcfafc89749ac3b6eec69bf.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:250'368 bytes
First seen:2023-04-02 08:04:11 UTC
Last seen:2023-04-02 08:36:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2131db44a5c98e05f373c247645871f9 (3 x Rhadamanthys, 2 x Smoke Loader, 2 x Amadey)
ssdeep 6144:Reh/H+Zhyu8Jfc080/OmUMo4gW2UhgSWtAg:0h/ahy80WmUMo4xlhgFtAg
Threatray 186 similar samples on MalwareBazaar
TLSH T1E0345C0252E46871E6225A728F2FC3F43B1EB8615E35BF9E2E5B7A3F05301A1D162F15
TrID 52.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.7% (.EXE) Win64 Executable (generic) (10523/12/4)
8.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.5% (.EXE) Win32 Executable (generic) (4505/5/1)
3.4% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 116a6e6a6a6a6a60 (6 x Rhadamanthys, 6 x Smoke Loader, 6 x RedLineStealer)
Reporter abuse_ch
Tags:exe Stealc

Intelligence

File Origin
# of uploads :
2
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
53ce3c478fcfafc89749ac3b6eec69bf.exe
Verdict:
Malicious activity
Analysis date:
2023-04-02 08:06:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2642e590-7977-4e37-b543-b7827fef0bea

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/379316/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.66207562.23824.17359.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file
Reading critical registry keys
Changing a file
Creating a file in the %AppData% subdirectories
Sending a custom TCP request
Creating a window
Running batch commands
Creating a process with a hidden window
Launching a process
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Query of malicious DNS domain
Stealing user critical data
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
azorult greyware lockbit packed
Link:
https://www.filescan.io/uploads/64293730c56b2da73aca6373/reports/7ac83887-5f68-466d-b348-8b2739820a6f/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/1f27ad0379e176ab51f8adaf154e0172dcdd11c2d4f09dd84c89f036f7a55199
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ae5943a3-88d6-4f38-bc6b-35335a33116d
Result
Threat name:
Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1206538
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking locale)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f27ad0379e176ab51f8adaf154e0172dcdd11c2d4f09dd84c89f036f7a55199/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2023-04-01 23:00:03 UTC
File Type:
PE (Exe)
Extracted files:
42
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d4t22a3z4f3kwupyvwxrktqbolon2eoc2tyj3wcmrhydn55fkgmq._file
Verdict:
malicious
Similar samples:
04fd3794814871b31fef000b51e51b6c20ad7646b3c74a585a668f95cf14fa06
Stealc
07a3bc87d6480a495505c6efe903bb1009c39f79fe7229631e1f1bd65c6ceebe
Stealc
1978eba30a4ec1374d09affead3a90d4175c97e58f34497d798aaa56e685df20
Stealc
4decda3f59361e62bca26d6c7406c5e8217fd25249fb03843ec78ba0c09416c8
Stealc
8384eb97c0fd7d916cdb454b2212794a8eafa37fe6c7165644d02e8d9bfe5237
Stealc
86d7dbb438477b8334304d10d719d750bf379a10e2fc02a5e29632e2ed3a101c
Stealc
979afbc8137f3cb684125b0f15be3c34d8539425366c3a067b98a97e181eb142
Stealc
b020c34a3b2b4bc4fbfa0ac4d3ca97283e2fdce71f737e1103bd638ed8f6647a
Stealc
b03a49e4d7224804379ff6281c5edcc49f89e2cdcb6f74db2224c415e7dff2fa
Stealc
ccd1cde08e07f3be31008ea2b7ace4190317f179c3a75e0b9e88670aa70626cb
Stealc
+ 176 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc discovery spyware stealer
Link:
https://tria.ge/reports/230402-jyvessgf6s/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Detects Stealc stealer
Stealc
Malware Config
C2 Extraction:
http://arthurmaes.top/410b5129171f10ea.php
Unpacked files
SH256 hash:
9de867a294deacb793afdf26c9b12a8eaa1276408212ae3cb7aec0b338fe119a
MD5 hash:
5258f253442a1816164d7f417558e39d
SHA1 hash:
f4b69f7411ad691a653d50fb5bea860ff01596b6
Detections:
stealc
Create hunting rule
win_stealc_a0
Create hunting rule
Link:
https://www.unpac.me/results/3d2a6867-39ac-4cb2-8992-a0f1417a2b76/
Parent samples :
15abda25306ba3ceeb816e87783ce6ed7d46248d068d2f5ac1e348d47de91633
86d7dbb438477b8334304d10d719d750bf379a10e2fc02a5e29632e2ed3a101c
b03a49e4d7224804379ff6281c5edcc49f89e2cdcb6f74db2224c415e7dff2fa
1f27ad0379e176ab51f8adaf154e0172dcdd11c2d4f09dd84c89f036f7a55199
8e11b66836fc4afa3bf1c102f072857ffb3ec2faa227e2f94c48bcef1f20cb19
SH256 hash:
1f27ad0379e176ab51f8adaf154e0172dcdd11c2d4f09dd84c89f036f7a55199
MD5 hash:
53ce3c478fcfafc89749ac3b6eec69bf
SHA1 hash:
e59dea08b60c0a67ccb135c2521e4d16631a904f
Link:
https://www.unpac.me/results/3d2a6867-39ac-4cb2-8992-a0f1417a2b76/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1f27ad0379e1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f27ad0379e176ab51f8adaf154e0172dcdd11c2d4f09dd84c89f036f7a55199

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:infostealer_win_stealc_standalone
Create hunting rule
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/
Rule name:Suspicious_Macro_Presence
Create hunting rule
Author:Mehmet Ali Kerimoglu (CYB3RMX)
Description:This rule detects common malicious/suspicious implementations.
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:win_stealc_w0
Create hunting rule
Author:crep1x
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 1f27ad0379e176ab51f8adaf154e0172dcdd11c2d4f09dd84c89f036f7a55199

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2591008/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2591006/
  
URLhaus
https://urlhaus.abuse.ch/url/2591005/
Cape
Cape
https://www.capesandbox.com/analysis/379316/

Comments