MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20af689a1596040d8150691b55df006755e0f6cdfe4fe8ef852d6c526ff888c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 18


Intelligence 18 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20af689a1596040d8150691b55df006755e0f6cdfe4fe8ef852d6c526ff888c2
SHA3-384 hash: a052372c9f8ea7d66b2339bd30ecc46e89c3cf310e40c8fc0c921978cf0f812280fa19cecf28c4a461636b90a8ac2da9
SHA1 hash: a600f122ee75d4764a0d830ba832ddf87a392e84
MD5 hash: 6430c1ebb5b57303ae46ed2cb30fd94a
humanhash: winter-foxtrot-east-football
File name:file
Download: download sample
Signature Stealc
Create hunting rule
File size:3'393'024 bytes
First seen:2025-09-04 04:00:53 UTC
Last seen:2025-09-04 11:47:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 83ff2a6950f98d2f65fd6b1c5c33e68a (5 x LummaStealer, 2 x Stealc)
ssdeep 49152:gEf96EtAFz464jYYSqNUPT954Y3m79Zkwcf:/F6EtgLXrp9275w
Threatray 122 similar samples on MalwareBazaar
TLSH T129F5BE19FC36D086ECE38071BF39C212D5222E77DF2C666B91DC49900165DEEA62E17B
TrID 63.5% (.EXE) Win64 Executable (generic) (10522/11/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey exe Stealc


Avatar
Bitsight
url: http://178.16.55.189/files/5296057416/Tse2E3k.exe

Intelligence

File Origin
# of uploads :
10
# of downloads :
74
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
d4d08a547c9b9d8aaf36ef12387f53d580343a58090ed0f89923d38774d0c774.exe
Verdict:
Malicious activity
Analysis date:
2025-09-03 19:36:09 UTC
Tags:
auto redline stealer amadey botnet arch-exec loader lumma rdp auto-reg
Link:
https://app.any.run/tasks/ad791a01-812a-4bdd-ab32-c8389f5c0471

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Stealc
Create hunting rule
Link:
https://www.capesandbox.com/analysis/24976/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b90f2beb163e0ec1844525
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP POST request
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
amadey fingerprint krypt lumma microsoft_visual_cc packed stealc unsafe
Link:
https://www.filescan.io/uploads/68b90f2039a6221faa7dda92/reports/eab8101f-fea4-4d9d-9305-43d2129cb5c3/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/20af689a1596040d8150691b55df006755e0f6cdfe4fe8ef852d6c526ff888c2
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-09-03T17:59:00Z UTC
Last seen:
2025-09-03T17:59:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/20af689a1596040d8150691b55df006755e0f6cdfe4fe8ef852d6c526ff888c2/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d417580d-d9cc-47ee-83df-6716a93c3f52
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/20af689a1596040d8150691b55df006755e0f6cdfe4fe8ef852d6c526ff888c2
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/6430c1ebb5b57303ae46ed2cb30fd94a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20af689a1596040d8150691b55df006755e0f6cdfe4fe8ef852d6c526ff888c2/
Verdict:
Malicious
Threat:
Family.STEALC
Link:
https://tip.neiki.dev/file/20af689a1596040d8150691b55df006755e0f6cdfe4fe8ef852d6c526ff888c2
Threat name:
Win64.Trojan.Lazy
Create hunting rule
Status:
Malicious
First seen:
2025-09-04 04:02:32 UTC
File Type:
PE+ (Exe)
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ecxwrgqvsyca3akqnenvlxyam5k6b5wn7zh6r34ffvwfe37yrdba._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
Similar samples:
02c22cb54244b9a05b47ce93046dbdbdee3724ae33e63799163975eaad85c698
Stealc
1a0cbe7bd1f4cdc7658ee4e9f674d7f6b0a44c7a76c2eef744eed0dea0b2e918
Stealc
20af689a1596040d8150691b55df006755e0f6cdfe4fe8ef852d6c526ff888c2
Stealc
4e636b744971cb7042265edfa52ee42b913d85cdcbdd4d1fa3df80cc05086d39
Stealc
6ee280efcad12a54fe6ab0dcf5db5f3b18658a9bce5c039cf0e1751804f5e617
Stealc
c797f29fc054fb80a5d7a6a66e9304b28fd36b48cfe6782daa70bf20aabf3ecf
Stealc
e08a7ed1e201f5564f8ec101f6f5faff7b93f3d72e340e707e0d4bead84ebe2b
Stealc
error
Stealc
+ 112 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:logsdillercloud discovery stealer
Link:
https://tria.ge/reports/250904-eljqbawn14/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Stealc
Stealc family
Malware Config
C2 Extraction:
http://libertyquality.shop
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3aaf28a1-48db-412e-a58a-6c1475f9936f
Unpacked files
SH256 hash:
20af689a1596040d8150691b55df006755e0f6cdfe4fe8ef852d6c526ff888c2
MD5 hash:
6430c1ebb5b57303ae46ed2cb30fd94a
SHA1 hash:
a600f122ee75d4764a0d830ba832ddf87a392e84
Link:
https://www.unpac.me/results/385f5c3b-97b7-4958-a43c-9b27542f539b/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/20af689a1596/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/20af689a1596040d8150691b55df006755e0f6cdfe4fe8ef852d6c526ff888c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HUNTING_SUSP_TLS_SECTION
Create hunting rule
Author:chaosphere
Description:Detect PE files with .tls section that can be used for anti-debugging
Reference:Practical Malware Analysis - Chapter 16
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 20af689a1596040d8150691b55df006755e0f6cdfe4fe8ef852d6c526ff888c2

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3607407/
Cape
Cape
https://www.capesandbox.com/analysis/24976/

Comments