MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2730123ca927015ac3021aedfc4bcb1086252ffb5b91a9dd98db221fbfc6b217. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 16


Intelligence 16 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2730123ca927015ac3021aedfc4bcb1086252ffb5b91a9dd98db221fbfc6b217
SHA3-384 hash: c3a918910ddd3661c16d30d8e999d3d512353d809bc8e89b34ae5f79ababb4b420a9f3a6f29902e4e649bade1c237372
SHA1 hash: 4e3797e05aa98cd7e940c313306cb0413a7cdb31
MD5 hash: 236c68d04da94270e7e11642ae2c8d98
humanhash: vermont-harry-sixteen-ohio
File name:file
Download: download sample
Signature Stealc
Create hunting rule
File size:484'352 bytes
First seen:2024-10-04 12:04:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 76c28592e04b2b2bb1f52b3aac6a5c55 (8 x Vidar, 4 x Stealc, 3 x LummaStealer)
ssdeep 12288:aNExbbYLHp+emGqnEZ9c68tO4Xoekq9k9+ImRqP:fJ+J+emGqEZB4Xwqy9jN
TLSH T1F2A4E051B5D18071D47318330AF0DBB69E7EF9714E729E9F67944BBE4F30280A621A2B
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Bitsight
Tags:exe Stealc


Avatar
Bitsight
url: http://jask.powerforxes.shop/ldms/956d73b7f041.exe#default15st

Intelligence

File Origin
# of uploads :
1
# of downloads :
353
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-10-04 12:18:21 UTC
Tags:
stealer stealc
Link:
https://app.any.run/tasks/8a01e5e4-9535-46e0-bd29-a175cda34462

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66ffd9b60fdf8887097d0cbc
Tags:
malware
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Searching for synchronization primitives
Сreating synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending an HTTP GET request to an infection source
Connection attempt to an infection source
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc fingerprint lolbin microsoft_visual_cc packed xwizard
Link:
https://www.filescan.io/uploads/66ffd9bd037d97bf2b5c076d/reports/bd7cce12-1976-45f6-804d-5dc0c450842b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/2730123ca927015ac3021aedfc4bcb1086252ffb5b91a9dd98db221fbfc6b217
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b233db56-3666-4b1f-bc77-f96739e9017b
Result
Threat name:
Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1525687
Signature
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Drops PE files to the document folder of the user
Drops PE files to the user root directory
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Searches for specific processes (likely to inject)
Sigma detected: Silenttrinity Stager Msbuild Activity
Suricata IDS alerts for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1525687 Sample: file.exe Startdate: 04/10/2024 Architecture: WINDOWS Score: 100 58 Suricata IDS alerts for network traffic 2->58 60 Found malware configuration 2->60 62 Antivirus detection for dropped file 2->62 64 12 other signatures 2->64 10 file.exe 2->10         started        process3 signatures4 70 Writes to foreign memory regions 10->70 72 Allocates memory in foreign processes 10->72 74 Injects a PE file into a foreign processes 10->74 13 MSBuild.exe 61 10->13         started        18 MSBuild.exe 10->18         started        20 WerFault.exe 22 16 10->20         started        22 MSBuild.exe 10->22         started        process5 dnsIp6 52 62.204.41.159, 49710, 80 TNNET-ASTNNetOyMainnetworkFI United Kingdom 13->52 54 176.113.115.37, 49823, 80 SELECTELRU Russian Federation 13->54 40 C:\Users\user\DocumentsKFCFBAAEHC.exe, PE32 13->40 dropped 42 C:\Users\user\AppData\...\softokn3[1].dll, PE32 13->42 dropped 44 C:\Users\user\AppData\Local\...\seed[1].exe, PE32 13->44 dropped 48 11 other files (7 malicious) 13->48 dropped 82 Tries to steal Mail credentials (via file / registry access) 13->82 84 Tries to harvest and steal ftp login credentials 13->84 86 Tries to harvest and steal browser information (history, passwords, etc) 13->86 96 2 other signatures 13->96 24 cmd.exe 1 13->24         started        88 Drops PE files to the document folder of the user 18->88 90 Drops PE files to the user root directory 18->90 92 Found evasive API chain (may stop execution after checking locale) 18->92 94 Searches for specific processes (likely to inject) 18->94 46 C:\ProgramData\Microsoft\...\Report.wer, Unicode 20->46 dropped file7 signatures8 process9 signatures10 66 Uses ping.exe to sleep 24->66 68 Uses ping.exe to check the status of other devices and networks 24->68 27 DocumentsKFCFBAAEHC.exe 4 24->27         started        30 conhost.exe 24->30         started        process11 signatures12 76 Antivirus detection for dropped file 27->76 78 Multi AV Scanner detection for dropped file 27->78 80 Machine Learning detection for dropped file 27->80 32 cmd.exe 1 27->32         started        process13 signatures14 56 Uses ping.exe to sleep 32->56 35 PING.EXE 1 32->35         started        38 conhost.exe 32->38         started        process15 dnsIp16 50 2.2.2.2 FranceTelecom-OrangeFR France 35->50
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2730123ca927015ac3021aedfc4bcb1086252ffb5b91a9dd98db221fbfc6b217
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2730123ca927015ac3021aedfc4bcb1086252ffb5b91a9dd98db221fbfc6b217/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2024-10-04 12:04:06 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e4ybepfje4avvqycdlw7ys6lccdckl73loi2txmy3mrb7p6gwilq._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
Similar samples:
error
Stealc
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:default5_doz credential_access discovery spyware stealer
Link:
https://tria.ge/reports/241004-n8k2bsxbmd/
Behaviour
Checks processor information in registry
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Unsecured Credentials: Credentials In Files
Checks computer location settings
Downloads MZ/PE file
Stealc
Malware Config
C2 Extraction:
http://62.204.41.159
Verdict:
Malicious
Tags:
stealc
YARA:
n/a
Link:
https://app.threat.zone/submission/d865a727-8c7a-44b4-9d78-b13f796e39d3
Unpacked files
SH256 hash:
29e7e1c1e1a7e5f26f6961d8036cdd04ee4557dec0a7dcadcd8e7651f5e53f43
MD5 hash:
2ec23e83e2f63ab27c25741b1f4d7f49
SHA1 hash:
bb231b274bd66393fa830a44e6d4447d4399eeb9
Link:
https://www.unpac.me/results/edc21449-d6a0-4855-9d07-33f49d07a780/
SH256 hash:
2e145192e413b1db4ebb7b726d8c9a4f23404229425a88455a095dc8b47edd2b
MD5 hash:
0480eba457a76f0ffbcc53958dfe88e9
SHA1 hash:
95ca50985d4a8162069185757001e9fd3e402964
Detections:
stealc
Create hunting rule
Link:
https://www.unpac.me/results/edc21449-d6a0-4855-9d07-33f49d07a780/
Parent samples :
141b94942464c19bbe918855f4268bd21c3e9014c98a55ce52ed71187eed1861
a84e56d23959591054296a99427ff69cc7dbda0555d61213438ee5f845381bda
ca42c2595f6d8a5b2534fb8ef53c9afdd118fd983da2bf59f3e714da90053b15
9a9a00de899875e4cc8ea6bac86f8950ff701c07349baef3d9a1fdf158dc6386
d498d07e1ddb734daef7968a218620d9251d480b0f10f1838365bfbd3387aba6
2730123ca927015ac3021aedfc4bcb1086252ffb5b91a9dd98db221fbfc6b217
0db238ecc6f027d553c26085977840865707bd24d2656656381d84c54e456206
da88bc40c7826a659ebd6da325bd04c9f52d4ceeef6916aafeef471c685a96b9
b986a005dc342782efd295081e8facc359647bf5f37a772294af3d65be47b7a6
7670b1054c425a8498f41ac29a964438dfc87b7f28245884637727444b5237ce
1f11629cc1cf4d00dbfbe5f11f5df7b5588dccac7e7cf85dc5e696703179ad28
97589cdb752317b0a8001b6faf0fceb68acd34c561b9a02b44b77cd3592e638c
SH256 hash:
2730123ca927015ac3021aedfc4bcb1086252ffb5b91a9dd98db221fbfc6b217
MD5 hash:
236c68d04da94270e7e11642ae2c8d98
SHA1 hash:
4e3797e05aa98cd7e940c313306cb0413a7cdb31
Link:
https://www.unpac.me/results/edc21449-d6a0-4855-9d07-33f49d07a780/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2730123ca927015ac3021aedfc4bcb1086252ffb5b91a9dd98db221fbfc6b217

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 2730123ca927015ac3021aedfc4bcb1086252ffb5b91a9dd98db221fbfc6b217

(this sample)

  
Dropped by
Privateloader
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3209788/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleWindow
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW

Comments