MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2683b5120c1f81caa318c093ddd9160fcec3a10f3ad35ccd459655bb08a8b0e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 17


Intelligence 17 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2683b5120c1f81caa318c093ddd9160fcec3a10f3ad35ccd459655bb08a8b0e7
SHA3-384 hash: 5edf174b9e899f60f39e4d31b57e848fc5ab1cae07ea0dd122b35a237b16f9dcf4d1e64c8cd1480c05fac70924eed452
SHA1 hash: b6c0a2f843d7d42605489aa574204456e3b168bf
MD5 hash: e240023d355ac679f74b0bd141b6384e
humanhash: harry-william-tennessee-skylark
File name:random.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:278'016 bytes
First seen:2024-07-29 15:19:12 UTC
Last seen:2024-07-29 15:21:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0722b909905e0c818f6dff651a45e15a (1 x Stealc)
ssdeep 3072:0B9HRxYS0NXgmhDPk1OLhCXqRBrL8+YEDj4hFrI6F7tWeKXgLSMvafu:i1Rx8Fgmlc02qXgXJr1tKQ3
Threatray 122 similar samples on MalwareBazaar
TLSH T1C844CF117280D471D5A715349878C2F66A7EBFB39674918B7BD83F2F2E312809A32F52
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.9% (.EXE) Win32 Executable (generic) (4504/4/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 1af2c2da98585c0c (2 x Stealc)
Reporter aachum
Tags:exe Stealc


Avatar
iamaachum
185.215.113.16/stealc/random.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
350
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
random.exe
Verdict:
Malicious activity
Analysis date:
2024-07-29 15:19:25 UTC
Tags:
stealer stealc
Link:
https://app.any.run/tasks/645ff5f5-b0dd-48bd-83c4-13b804e51dc8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a7b325c06bd32e596e617a
Tags:
Banker Encryption Execution Network Stealth Dexter
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/66a7b32c4c5c17942a7fa942/reports/cced45a2-504a-4012-ab56-7b81a871124f/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/2683b5120c1f81caa318c093ddd9160fcec3a10f3ad35ccd459655bb08a8b0e7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8f92209e-4d97-4bf0-8520-17fa2d75e698
Result
Threat name:
Amadey, Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1484150
Signature
AI detected suspicious sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: Suspicious File Creation In Uncommon AppData Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Amadeys stealer DLL
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1484150 Sample: random.exe Startdate: 29/07/2024 Architecture: WINDOWS Score: 100 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus detection for URL or domain 2->53 55 15 other signatures 2->55 8 random.exe 37 2->8         started        13 explorti.exe 2->13         started        15 explorti.exe 12 2->15         started        process3 dnsIp4 43 85.28.47.31, 49704, 80 GES-ASRU Russian Federation 8->43 45 185.215.113.16, 49705, 80 WHOLESALECONNECTIONSNL Portugal 8->45 35 C:\Users\user\AppData\RoamingEBAKEBAECG.exe, PE32 8->35 dropped 37 C:\Users\user\AppData\...\softokn3[1].dll, PE32 8->37 dropped 39 C:\Users\user\AppData\Local\...\random[1].exe, PE32 8->39 dropped 41 11 other files (7 malicious) 8->41 dropped 65 Detected unpacking (changes PE section rights) 8->65 67 Detected unpacking (overwrites its own PE header) 8->67 69 Tries to steal Mail credentials (via file / registry access) 8->69 83 6 other signatures 8->83 17 cmd.exe 1 8->17         started        19 WerFault.exe 19 16 8->19         started        71 Antivirus detection for dropped file 13->71 73 Multi AV Scanner detection for dropped file 13->73 75 Tries to detect sandboxes and other dynamic analysis tools (window names) 13->75 85 3 other signatures 13->85 47 185.215.113.19, 49726, 49727, 49728 WHOLESALECONNECTIONSNL Portugal 15->47 77 Hides threads from debuggers 15->77 79 Tries to detect sandboxes / dynamic malware analysis system (registry check) 15->79 81 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 15->81 file5 signatures6 process7 file8 22 RoamingEBAKEBAECG.exe 4 17->22         started        26 conhost.exe 17->26         started        31 C:\ProgramData\Microsoft\...\Report.wer, Unicode 19->31 dropped process9 file10 33 C:\Users\user\AppData\Local\...\explorti.exe, PE32 22->33 dropped 57 Antivirus detection for dropped file 22->57 59 Multi AV Scanner detection for dropped file 22->59 61 Detected unpacking (changes PE section rights) 22->61 63 6 other signatures 22->63 28 explorti.exe 22->28         started        signatures11 process12 signatures13 87 Hides threads from debuggers 28->87 89 Tries to detect sandboxes / dynamic malware analysis system (registry check) 28->89 91 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 28->91
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2683b5120c1f81caa318c093ddd9160fcec3a10f3ad35ccd459655bb08a8b0e7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2683b5120c1f81caa318c093ddd9160fcec3a10f3ad35ccd459655bb08a8b0e7/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2024-07-29 14:50:22 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e2b3keqmd6a4viyyycj53wiwb7hmhiiphljvztkfszk3wcfiwdtq._file
Verdict:
malicious
Similar samples:
0c1f6f5b1b5805fad2aa86fe12b6e24be69565c46d179b5eb8ce76614f3e2993
Stealc
164865d694e4965f098342edfd6aa0271ff757948813f74f7eb4138fcf596932
Stealc
8e30088691e13e06713d21bc9c56c1e539eb42cb42ec9acb3de4b7243b796b12
Stealc
a742195deed206c4ece07a4ee6f72f9ea2463ceb5ca9587f82758829c20571cc
Stealc
c2643566b7886f6c16bc19e6eb804a7791bc713ae18b27f0d7fca938ca8f6817
Stealc
d264838d9f1199dc54fc71623623bfcca58f05dbbfe958424c2758bc655dfcaa
Stealc
d747ab8be3ac467112c7325ba1cd57111cc080a98da6672c81be5a91dfbd9a56
Stealc
+ 112 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:dana discovery stealer
Link:
https://tria.ge/reports/240729-sqq7vavann/
Behaviour
Program crash
System Location Discovery: System Language Discovery
Stealc
Malware Config
C2 Extraction:
http://85.28.47.31
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bb8afd17-0e86-4e42-9463-63195fd13293
Unpacked files
SH256 hash:
144b0da90e8a3721a58d22b460b017854a11c308578ad7f5e3825361fa1cfa5c
MD5 hash:
efedc80482b249d448d8939f4347dd04
SHA1 hash:
b7abc85ad9cc52c264473493b28df8aad2eb0be8
Detections:
stealc
Create hunting rule
Link:
https://www.unpac.me/results/1e42b76b-988a-44eb-8f84-f44eff3a81a4/
Parent samples :
2683b5120c1f81caa318c093ddd9160fcec3a10f3ad35ccd459655bb08a8b0e7
e26d7dabcf5095750d11407a9341af6c898034b75f9fff158cc4c4757ec9f51a
ca248fc7d8d93e7ea0260391cec1402b03619fb6475402a847952837ca4ae4e9
b3f54c2bfe8d4056bdd9e6ff8d9114bf38b6c9ee11b3355e108c233a197fb145
745c8f38e2cd894f6ce759e3096333b3b219a25bdf1446558cac4a92d0cb4e51
48d6fa1f938ce3fa2d54e27373ad93fe13936362d187881a9ba63e9da5946e42
SH256 hash:
2683b5120c1f81caa318c093ddd9160fcec3a10f3ad35ccd459655bb08a8b0e7
MD5 hash:
e240023d355ac679f74b0bd141b6384e
SHA1 hash:
b6c0a2f843d7d42605489aa574204456e3b168bf
Link:
https://www.unpac.me/results/1e42b76b-988a-44eb-8f84-f44eff3a81a4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2683b5120c1f81caa318c093ddd9160fcec3a10f3ad35ccd459655bb08a8b0e7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 2683b5120c1f81caa318c093ddd9160fcec3a10f3ad35ccd459655bb08a8b0e7

(this sample)

  
Link
https://tria.ge/240729-sjzkmsybrc
  
Dropped by
PrivateLoader
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3067417/
  
URLhaus
https://urlhaus.abuse.ch/url/3067432/
  
URLhaus
https://urlhaus.abuse.ch/url/3068410/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetDiskFreeSpaceExA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleInputW
KERNEL32.dll::PeekConsoleInputA
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleAliasesA
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateHardLinkA
KERNEL32.dll::CreateFileMappingA
KERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileW
KERNEL32.dll::ReplaceFileA
KERNEL32.dll::GetSystemDirectoryW

Comments