MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2818498f5686279b9a8ed4e58a6e7106364c28048c218f4b31bc7c6e2f0ddb17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2818498f5686279b9a8ed4e58a6e7106364c28048c218f4b31bc7c6e2f0ddb17
SHA3-384 hash: ffd01cebcd34f7e5880d33ac9805fb2cc31e286b8dd3bdcd566cd7408fbd014115083896acddd3dea14af554ce78f2e5
SHA1 hash: b151204191839e8e62abdb3d660e81c2935ce221
MD5 hash: 38e3faad153897813215e40452fe9e3f
humanhash: nevada-queen-enemy-kilo
File name:38e3faad153897813215e40452fe9e3f.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:364'544 bytes
First seen:2024-10-25 11:10:17 UTC
Last seen:2024-10-25 12:02:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a4998b9776f8dadc865f87af5d236a55 (2 x Stealc)
ssdeep 6144:lzx6pexKrCWIUynh6mT/icTCb7JAywEvdH:RxWetUiuoCb7HwI
TLSH T1F4747C5166F1C826EEB78B354934E7AF193BBCE67A71918E21403A0F39337918991F13
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon 0408120301090400 (1 x Stealc)
Reporter abuse_ch
Tags:exe Stealc


Avatar
abuse_ch
Stealc C2:
http://185.241.61.210/849647684a13b905.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://185.241.61.210/849647684a13b905.php https://threatfox.abuse.ch/ioc/1339335/

Intelligence

File Origin
# of uploads :
2
# of downloads :
451
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
38e3faad153897813215e40452fe9e3f.exe
Verdict:
Malicious activity
Analysis date:
2024-10-25 11:12:57 UTC
Tags:
stealer stealc loader miner
Link:
https://app.any.run/tasks/195f6134-6d37-4a36-a07a-45068ae8f73c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.PWS.StealC.5.24628.7387.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=671b7cc8a75e41aa6721611f
Tags:
Powershell Cobalt Lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending an HTTP GET request
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
exploit fingerprint microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/671b7cc70f780125dba230f1/reports/92655dd6-7289-4f1b-8fca-0d84cdbf322c/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/2818498f5686279b9a8ed4e58a6e7106364c28048c218f4b31bc7c6e2f0ddb17
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/235481fa-be91-4d24-b73b-e2ce683baee4
Result
Threat name:
Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1542029
Signature
Adds a directory exclusion to Windows Defender
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies power options to not sleep / hibernate
Modifies the hosts file
Multi AV Scanner detection for dropped file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Searches for specific processes (likely to inject)
Sigma detected: Disable power options
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Stop EventLog
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses powercfg.exe to modify the power settings
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1542029 Sample: 3WffcqLN3q.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 100 76 sirault.be 2->76 88 Suricata IDS alerts for network traffic 2->88 90 Found malware configuration 2->90 92 Malicious sample detected (through community Yara rule) 2->92 94 11 other signatures 2->94 10 3WffcqLN3q.exe 36 2->10         started        15 updater.exe 2->15         started        17 svchost.exe 3 8 2->17         started        19 svchost.exe 11 1 2->19         started        signatures3 process4 dnsIp5 80 185.241.61.210, 49705, 80 ULX-UKGB unknown 10->80 82 sirault.be 185.98.131.200, 443, 49728 RMI-FITECHFR France 10->82 64 C:\Users\user\AppData\...\softokn3[1].dll, PE32 10->64 dropped 66 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 10->66 dropped 68 C:\Users\user\AppData\...\mozglue[1].dll, PE32 10->68 dropped 70 10 other files (6 malicious) 10->70 dropped 98 Detected unpacking (changes PE section rights) 10->98 100 Detected unpacking (overwrites its own PE header) 10->100 102 Tries to steal Mail credentials (via file / registry access) 10->102 110 6 other signatures 10->110 21 cmd.exe 1 10->21         started        23 WerFault.exe 19 16 10->23         started        104 Multi AV Scanner detection for dropped file 15->104 106 Query firmware table information (likely to detect VMs) 15->106 108 Tries to detect sandboxes and other dynamic analysis tools (window names) 15->108 112 4 other signatures 15->112 27 WerFault.exe 2 17->27         started        84 20.190.160.20 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 19->84 86 40.126.32.136 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 19->86 file6 signatures7 process8 dnsIp9 29 HIJEGDBGDB.exe 1 3 21->29         started        33 conhost.exe 21->33         started        78 52.168.117.173 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 23->78 62 C:\ProgramData\Microsoft\...\Report.wer, Unicode 23->62 dropped file10 process11 file12 72 C:\ProgramDatabehaviorgraphoogle\Chrome\updater.exe, PE32+ 29->72 dropped 74 C:\Windows\System32\drivers\etc\hosts, ASCII 29->74 dropped 114 Multi AV Scanner detection for dropped file 29->114 116 Query firmware table information (likely to detect VMs) 29->116 118 Uses powercfg.exe to modify the power settings 29->118 120 7 other signatures 29->120 35 powershell.exe 23 29->35         started        38 cmd.exe 29->38         started        40 sc.exe 29->40         started        42 12 other processes 29->42 signatures13 process14 signatures15 96 Loading BitLocker PowerShell Module 35->96 44 WmiPrvSE.exe 35->44         started        46 conhost.exe 35->46         started        48 conhost.exe 38->48         started        50 wusa.exe 38->50         started        52 conhost.exe 40->52         started        54 conhost.exe 42->54         started        56 conhost.exe 42->56         started        58 conhost.exe 42->58         started        60 9 other processes 42->60 process16
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2818498f5686279b9a8ed4e58a6e7106364c28048c218f4b31bc7c6e2f0ddb17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2818498f5686279b9a8ed4e58a6e7106364c28048c218f4b31bc7c6e2f0ddb17/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fametd2wqytzxguo2tsyu3tray3eykaerqqy6szrxr6g4lyn3mlq._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
shellcode_loader_002
Create hunting rule
Similar samples:
error
Stealc
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:stealc family:xmrig botnet:logsdiller credential_access discovery evasion execution miner persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/241025-m99weazblj/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Power Settings
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Themida packer
Unsecured Credentials: Credentials In Files
Command and Scripting Interpreter: PowerShell
Creates new service(s)
Downloads MZ/PE file
Drops file in Drivers directory
Stops running service(s)
Identifies VirtualBox via ACPI registry values (likely anti-VM)
XMRig Miner payload
Stealc
xmrig
Malware Config
C2 Extraction:
http://185.241.61.210
Verdict:
Malicious
Tags:
stealc
YARA:
n/a
Link:
https://app.threat.zone/submission/29343a29-9b2b-4ba8-a2fd-d2071299f14c
Unpacked files
SH256 hash:
9b2188cf15a7411aecdc039074369aa0a37f265b75585de89f93b23fd755bfc0
MD5 hash:
629a4efd68850a5770cf6b80533ff551
SHA1 hash:
010ef34816bc38a8d88f9c8d41b226d0cc5edecc
Detections:
stealc
Create hunting rule
detect_Mars_Stealer
Create hunting rule
Link:
https://www.unpac.me/results/d2b492c0-988b-40f6-834f-fb4d855c3528/
Parent samples :
2818498f5686279b9a8ed4e58a6e7106364c28048c218f4b31bc7c6e2f0ddb17
5fd4b6c1b58ff9016562ab9ec9020461fe2452b389e360dd83cbe2ab2eb30fae
5dffe3668ba7b8a66c24d5941411986adc79331598e84a3152a41f1c487be2ff
f86f8946cd8542658cae08d7fd9664c5896c767f6854bdbf249cdc503c71baeb
d4fb1d477d76d59c6fe2c4fada775618f998010ea7a81e07533d3c80ae57c903
SH256 hash:
29e7e1c1e1a7e5f26f6961d8036cdd04ee4557dec0a7dcadcd8e7651f5e53f43
MD5 hash:
2ec23e83e2f63ab27c25741b1f4d7f49
SHA1 hash:
bb231b274bd66393fa830a44e6d4447d4399eeb9
Link:
https://www.unpac.me/results/d2b492c0-988b-40f6-834f-fb4d855c3528/
SH256 hash:
2818498f5686279b9a8ed4e58a6e7106364c28048c218f4b31bc7c6e2f0ddb17
MD5 hash:
38e3faad153897813215e40452fe9e3f
SHA1 hash:
b151204191839e8e62abdb3d660e81c2935ce221
Link:
https://www.unpac.me/results/d2b492c0-988b-40f6-834f-fb4d855c3528/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2818498f5686279b9a8ed4e58a6e7106364c28048c218f4b31bc7c6e2f0ddb17

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 2818498f5686279b9a8ed4e58a6e7106364c28048c218f4b31bc7c6e2f0ddb17

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3243375/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3243294/
  
URLhaus
https://urlhaus.abuse.ch/url/3243349/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::DeleteVolumeMountPointW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleA
KERNEL32.dll::ReadConsoleOutputCharacterW
KERNEL32.dll::SetConsoleTitleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleFontSize
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateFileA
KERNEL32.dll::MoveFileExA
KERNEL32.dll::MoveFileW
KERNEL32.dll::GetFileAttributesW
KERNEL32.dll::GetSystemWow64DirectoryW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameA
WIN_HTTP_APIUses HTTP servicesWINHTTP.dll::WinHttpOpenRequest
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::QueryServiceLockStatusW

Comments