MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22cb2fba2dde578f61c82ed450c88c9060629fa7736bb7e27a584c97473c0883. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CrealStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22cb2fba2dde578f61c82ed450c88c9060629fa7736bb7e27a584c97473c0883
SHA3-384 hash: 1a6a4548d11938c8b7c8788cce6ef0cd43eb17242ba7c293b3459f03caafde543ec663db0705c61863cf296b2255b651
SHA1 hash: b6e52506741ba627a96e681cb381db90c3fd21ca
MD5 hash: 00b471bd631a06fb4b21b345effb880b
humanhash: grey-sweet-lemon-arkansas
File name:Creal.exe
Download: download sample
Signature CrealStealer
Create hunting rule
File size:15'620'263 bytes
First seen:2023-02-04 19:09:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b5552dccd9d0a834cea55c0c8fc05be (16 x LunaLogger, 16 x BlankGrabber, 8 x CrealStealer)
ssdeep 393216:GxAlnAT6K4/m3pWFqyoBgsSI7oeCMJf0:XlAWK4K91p75CMJ0
Threatray 68 similar samples on MalwareBazaar
TLSH T126F633611BA848DBDCE5213BC90FD86D55B4BC121794D18F81A9A30D2F73352AE3BFA1
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon c6c2ccc4f4e0e0f8 (37 x PythonStealer, 21 x CrealStealer, 19 x Empyrean)
Reporter Anonymous
Tags:CrealStealer exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
236
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Creal.exe
Verdict:
Malicious activity
Analysis date:
2023-02-04 19:10:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f4a9c89b-641b-4fc6-9eac-c3eb496f3541

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.HEUR.Trojan-PSW.Python.Agent.gen.8588.26986.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Creating a file
Reading critical registry keys
Creating a file in the %AppData% subdirectories
DNS request
Sending a custom TCP request
Creating a window
Using the Windows Management Instrumentation requests
Searching for the window
Launching a tool to kill processes
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/65306/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed python
Link:
https://www.filescan.io/uploads/63dead8d89bd67c10fdc8927/reports/68623fee-5282-4a9c-a455-6a14495de10d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/22cb2fba2dde578f61c82ed450c88c9060629fa7736bb7e27a584c97473c0883
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d29b71b2-8db7-4f12-8bfb-7d3bcb1af2a6
Result
Threat name:
Creal Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1165821
Signature
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Creal Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22cb2fba2dde578f61c82ed450c88c9060629fa7736bb7e27a584c97473c0883/
Threat name:
Win64.Infostealer.Disco
Create hunting rule
Status:
Malicious
First seen:
2023-02-04 19:10:24 UTC
File Type:
PE+ (Exe)
Extracted files:
1866
AV detection:
11 of 26 (42.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=elfs7orn3zly6yoif3kfbsemsbqgfh5honv3pyt2lbgjorz4bcbq._file
Verdict:
unknown
Similar samples:
08da286f669199a5c2b131f66614bbb3718b159e48885f4a2b1c9af718256dd0
CrealStealer
12a23889a21d1682c204c2530270c5e80d0666f00382ee14bed50babf68daa83
CrealStealer
61b16d71a76f83cef63d079b0735cd0a1cee24f1119063e28ef1f227f2bb27c4
CrealStealer
75e9498c9de4ca202f86709a5b58448b64f09ab94440007fe6a9a0ea7c1e633e
CrealStealer
82b53444cb1607da0d82f371e6976f765a236a1468e88f6385ee24f2e6f5d1bb
CrealStealer
8e4ce102a531d540a1f643396d6ddfc0da9acc963ca995bcba9d07909ebb58e0
CrealStealer
a20cc7c8887cad9fce369f6b2113b21958926bdef91f6b544f01bbbbd2b12dc7
CrealStealer
a3d391dac8cecf22acc946063a6c0afe18d3778cbdfc168b96b67fe5c15d9494
CrealStealer
bb072637f15adf01881b15d6be17c943d912816b43cd843ca90089d56e638c0f
CrealStealer
c6af2ec456ad02b9eb3faf9fd9384d3dc43a55e7b1a58eec4440ee4bde1e99ce
CrealStealer
+ 58 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller spyware stealer upx
Link:
https://tria.ge/reports/230204-xvcx8sec25/
Behaviour
Suspicious use of WriteProcessMemory
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
UPX packed file
Unpacked files
SH256 hash:
22cb2fba2dde578f61c82ed450c88c9060629fa7736bb7e27a584c97473c0883
MD5 hash:
00b471bd631a06fb4b21b345effb880b
SHA1 hash:
b6e52506741ba627a96e681cb381db90c3fd21ca
Link:
https://www.unpac.me/results/2779f7dc-7b96-49d8-ba25-81e43794da06/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/22cb2fba2dde578f61c82ed450c88c9060629fa7736bb7e27a584c97473c0883

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments