MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23f0440bae78c2d40ebdf75a4127857fd531ea167e7525271330e966e24fa13a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23f0440bae78c2d40ebdf75a4127857fd531ea167e7525271330e966e24fa13a
SHA3-384 hash: bf35f27d4d2e0edbae79adafcff4d69817850954107775bf510a6585aecc65cdfa7f4d983bb0193fc785ab15e4735a85
SHA1 hash: 2b901307b4262f2b27461dd532a79582218a80e9
MD5 hash: e1b6ac741d81250e1374a828beeaf9fd
humanhash: helium-mango-bakerloo-nevada
File name:e1b6ac741d81250e1374a828beeaf9fd.msi
Download: download sample
Signature Stealc
Create hunting rule
File size:3'832'000 bytes
First seen:2023-03-17 13:10:30 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:LpUPlOPlQRNDP9nqI5KKs2p8iYu9ap7QqKHKG+n2H6h1Ug:LpTt4NDVPKB2vinG8n2Hs
TLSH T1C00613913340C326EA6BC8305E57839D9659ECA4EA207C47E2A4F7DF463ABC35EE5710
TrID 98.2% (.MSI) Microsoft Windows Installer (454500/1/170)
1.7% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter abuse_ch
Tags:msi Stealc


Avatar
abuse_ch
Stealc C2:
http://193.233.20.145/d27b1d581e3729a6.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/375097/
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
expand.exe fingerprint packed shell32.dll
Link:
https://www.filescan.io/uploads/641466eac65d1ebf04c10421/reports/94a7718f-257c-4b43-8da5-a23eaf7c35f9/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/23f0440bae78c2d40ebdf75a4127857fd531ea167e7525271330e966e24fa13a
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/23f0440bae78c2d40ebdf75a4127857fd531ea167e7525271330e966e24fa13a
Result
Threat name:
Stealc
Create hunting rule
Detection:
malicious
Classification:
troj.rans.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1195843
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking locale)
Found potential ransomware demand text
Injects a PE file into a foreign processes
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected Generic Downloader
Yara detected Stealc
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 828740 Sample: J9TgDYgZTm.msi Startdate: 17/03/2023 Architecture: WINDOWS Score: 100 74 Snort IDS alert for network traffic 2->74 76 Multi AV Scanner detection for domain / URL 2->76 78 Antivirus detection for URL or domain 2->78 80 6 other signatures 2->80 10 msiexec.exe 13 19 2->10         started        13 msiexec.exe 5 2->13         started        process3 file4 62 C:\Windows\Installer\MSIF838.tmp, PE32 10->62 dropped 64 C:\Windows\Installer\MSI2715.tmp, PE32 10->64 dropped 15 msiexec.exe 5 10->15         started        17 SrTasks.exe 2 10->17         started        process5 process6 19 Bpznb.exe 3 15->19         started        22 expand.exe 8 15->22         started        25 icacls.exe 1 15->25         started        27 icacls.exe 1 15->27         started        29 conhost.exe 17->29         started        file7 82 Found evasive API chain (may stop execution after checking locale) 19->82 84 Injects a PE file into a foreign processes 19->84 31 Bpznb.exe 39 19->31         started        36 Bpznb.exe 19->36         started        38 Bpznb.exe 19->38         started        58 C:\Users\user\AppData\...\Bpznb.exe (copy), PE32 22->58 dropped 60 C:\...\e0f964ac190acf41a474d1e444b8e826.tmp, PE32 22->60 dropped 40 conhost.exe 22->40         started        42 conhost.exe 25->42         started        44 conhost.exe 27->44         started        signatures8 process9 dnsIp10 66 193.233.20.145, 49810, 80 REDCOM-ASRedcomKhabarovskRussiaRU Russian Federation 31->66 68 84.252.94.185, 80 INETLTDTR Turkey 31->68 50 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 31->50 dropped 52 C:\Users\user\AppData\...\softokn3[1].dll, PE32 31->52 dropped 54 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 31->54 dropped 56 9 other files (none is malicious) 31->56 dropped 70 Tries to steal Mail credentials (via file / registry access) 31->70 72 Tries to harvest and steal browser information (history, passwords, etc) 31->72 46 cmd.exe 4 31->46         started        file11 signatures12 process13 process14 48 conhost.exe 46->48         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23f0440bae78c2d40ebdf75a4127857fd531ea167e7525271330e966e24fa13a/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=epyeic5opdbnidv565necj4fp7ktd2qwpz2skjytgduwnyspue5a._file
Verdict:
malicious
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc discovery stealer
Link:
https://tria.ge/reports/230317-qeyrfaac7y/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Drops file in Windows directory
Suspicious use of SetThreadContext
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Downloads MZ/PE file
Detects Stealc stealer
Stealc
Malware Config
C2 Extraction:
http://193.233.20.145
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/23f0440bae78c2d40ebdf75a4127857fd531ea167e7525271330e966e24fa13a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Microsoft Software Installer (MSI) msi 23f0440bae78c2d40ebdf75a4127857fd531ea167e7525271330e966e24fa13a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2573649/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/375097/

Comments