MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28a2f06c05fc57ff938deaf782e23986962785e947fb7922454779d33b0c9a84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28a2f06c05fc57ff938deaf782e23986962785e947fb7922454779d33b0c9a84
SHA3-384 hash: 8090f76dcc2e44ca4dcfa852eaba87b66d984e8d202ee1e3f321cdf792018dd025102bba5533e3129988c8a7740bb3f5
SHA1 hash: 260d62353d3d57326b9e88bfc61384d47d2ed58d
MD5 hash: d5c0d9e9b7ab82909616db51853f52fb
humanhash: five-tennis-edward-maine
File name:d5c0d9e9b7ab82909616db51853f52fb.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:6'429'184 bytes
First seen:2023-12-19 10:35:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 196608:qDvaZfDkVDSeTmU968Yiblh941pH8zabv:q+ZfCSCmT8YiBh2pcz2
Threatray 665 similar samples on MalwareBazaar
TLSH T10E56334AF3985467CCD9173588F6536305397C2162B8C1B9AACCA98B5E21BE1F87037F
TrID 41.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
22.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
11.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
7.5% (.EXE) Win64 Executable (generic) (10523/12/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:exe Stealc


Avatar
abuse_ch
Stealc C2:
77.105.132.87:17066

Intelligence

File Origin
# of uploads :
1
# of downloads :
396
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/468474/
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Launching a process
Searching for the browser window
Behavior that indicates a threat
DNS request
Sending a custom TCP request
Searching for the window
Searching for analyzing tools
Reading critical registry keys
Creating a file
Running batch commands
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
advpack anti-vm CAB control explorer installer installer lolbin lolbin net packed rundll32 setupapi sfx shell32
Link:
https://www.filescan.io/uploads/658172146b1c246046fbdeb5/reports/7452273f-c4d2-492c-9bef-d71a0a3afeee/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/28a2f06c05fc57ff938deaf782e23986962785e947fb7922454779d33b0c9a84
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/59a32172-321c-4b0a-83a6-4aca1b94df81
Result
Threat name:
RisePro Stealer, SmokeLoader, Vidar, zgR
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1364455
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Binary is likely a compiled AutoIt script file
Contains functionality to modify clipboard data
Detected unpacking (changes PE section rights)
Found API chain indicative of sandbox detection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has a writeable .text section
Phishing site detected (based on logo match)
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected RisePro Stealer
Yara detected SmokeLoader
Yara detected Vidar stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1364455 Sample: eLR6OesBAM.exe Startdate: 19/12/2023 Architecture: WINDOWS Score: 100 115 stun.l.google.com 2->115 117 ipinfo.io 2->117 119 api.steampowered.com 2->119 133 Snort IDS alert for network traffic 2->133 135 Malicious sample detected (through community Yara rule) 2->135 137 Antivirus detection for dropped file 2->137 139 14 other signatures 2->139 11 eLR6OesBAM.exe 1 4 2->11         started        14 FANBooster131.exe 2->14         started        17 MaxLoonaFest131.exe 2->17         started        19 7 other processes 2->19 signatures3 process4 file5 113 2 other malicious files 11->113 dropped 21 cX6ND33.exe 1 4 11->21         started        97 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 14->97 dropped 99 C:\...\WPgiwF8ZfmYv7rJxASvEn4DElHMl3KAv.zip, Zip 14->99 dropped 167 Multi AV Scanner detection for dropped file 14->167 169 Detected unpacking (changes PE section rights) 14->169 171 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 14->171 185 5 other signatures 14->185 101 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 17->101 dropped 103 C:\...\mnIlTt8EpeCYPTrKiY36b1wE6LC5L0Hp.zip, Zip 17->103 dropped 173 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 17->173 175 Query firmware table information (likely to detect VMs) 17->175 177 Tries to steal Mail credentials (via file / registry access) 17->177 25 WerFault.exe 17->25         started        105 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 19->105 dropped 107 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 19->107 dropped 109 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 19->109 dropped 111 C:\...\BpH48WMGXKxnq7udAKCK7MAhCgMfbC9L.zip, Zip 19->111 dropped 179 Machine Learning detection for dropped file 19->179 181 Hides threads from debuggers 19->181 183 Tries to detect sandboxes / dynamic malware analysis system (registry check) 19->183 27 WerFault.exe 19->27         started        29 WerFault.exe 19->29         started        31 WerFault.exe 19->31         started        33 chrome.exe 19->33         started        signatures6 process7 file8 85 C:\Users\user\AppData\Local\...85n1vE33.exe, PE32 21->85 dropped 87 C:\Users\user\AppData\Local\...\6ZT8wU0.exe, PE32 21->87 dropped 145 Antivirus detection for dropped file 21->145 147 Multi AV Scanner detection for dropped file 21->147 149 Machine Learning detection for dropped file 21->149 35 Nn1vE33.exe 1 4 21->35         started        signatures9 process10 file11 81 C:\Users\user\AppData\Local\...\4XS519WR.exe, PE32 35->81 dropped 83 C:\Users\user\AppData\Local\...\1fN53xb1.exe, PE32 35->83 dropped 141 Multi AV Scanner detection for dropped file 35->141 143 Machine Learning detection for dropped file 35->143 39 4XS519WR.exe 16 41 35->39         started        44 1fN53xb1.exe 12 35->44         started        signatures12 process13 dnsIp14 123 91.92.249.253 THEZONEBG Bulgaria 39->123 125 ipinfo.io 34.117.186.192 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 39->125 89 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 39->89 dropped 91 C:\Users\user\AppData\...\FANBooster131.exe, PE32 39->91 dropped 93 C:\Users\user\AppData\...\MaxLoonaFest131.exe, PE32 39->93 dropped 95 2 other malicious files 39->95 dropped 151 Multi AV Scanner detection for dropped file 39->151 153 Detected unpacking (changes PE section rights) 39->153 155 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 39->155 165 8 other signatures 39->165 46 cmd.exe 39->46         started        49 cmd.exe 39->49         started        51 WerFault.exe 39->51         started        157 Binary is likely a compiled AutoIt script file 44->157 159 Machine Learning detection for dropped file 44->159 161 Found API chain indicative of sandbox detection 44->161 163 Contains functionality to modify clipboard data 44->163 53 chrome.exe 9 44->53         started        56 chrome.exe 44->56         started        58 chrome.exe 44->58         started        60 6 other processes 44->60 file15 signatures16 process17 dnsIp18 187 Uses schtasks.exe or at.exe to add and modify task schedules 46->187 73 2 other processes 46->73 75 2 other processes 49->75 121 239.255.255.250 unknown Reserved 53->121 62 chrome.exe 53->62         started        77 2 other processes 53->77 65 chrome.exe 56->65         started        67 chrome.exe 58->67         started        69 chrome.exe 60->69         started        71 chrome.exe 60->71         started        79 4 other processes 60->79 signatures19 process20 dnsIp21 127 192.168.2.11 unknown unknown 62->127 129 twitter.com 104.244.42.1 TWITTERUS United States 62->129 131 110 other IPs or domains 62->131
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/28a2f06c05fc57ff938deaf782e23986962785e947fb7922454779d33b0c9a84
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28a2f06c05fc57ff938deaf782e23986962785e947fb7922454779d33b0c9a84/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-12-19 10:36:06 UTC
File Type:
PE (Exe)
Extracted files:
176
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fcrpa3af7rl77e4n5l3yfyrzq2lcpbpji75xsisfi545goymtkca._file
Verdict:
unknown
Similar samples:
1375f86609d8fe34f907a85a718851c42109bfda03d3000394d04fe63d8a1b7e
Stealc
237dd269593914e0571b27022a25a61f4fb3a1af73c66e39711c611f0a7985e3
Stealc
7bf2f95c02d6a67164588318e925ce09a8da25f5f5f71e50a3fcd84bf84c91f0
Stealc
9b3952230a10885ddf0d4815d7a4c5af0ad295bff36054bfc064dc0b224ddb74
Stealc
ec7009dcfa00590b20f95acf3a8989e0a9b0dc3a8a339e74847e5f2f8dff999b
Stealc
f8e284bd0abd20b927c85a295144921ccdb547701cc0bf724f9ca60fbaea124e
Stealc
+ 655 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
brand:google brand:paypal evasion persistence phishing themida trojan
Link:
https://tria.ge/reports/231219-mm8d3afbf9/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Enumerates physical storage devices
AutoIT Executable
Detected potential entity reuse from brand paypal.
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks whether UAC is enabled
Checks BIOS information in registry
Executes dropped EXE
Loads dropped DLL
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Detected google phishing page
Unpacked files
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/bc55b012-e92d-47c3-bf36-6bdd6ee65643/
SH256 hash:
fd5c6c3efdd80bfec88d9bb659bf3426da06fd5d4bc5943aee49e2ec1da446b0
MD5 hash:
a256d4719bb5197ff542ab4d972e40fa
SHA1 hash:
aa490e4b37bb5abc7d3c62b54731eb75bba56bb3
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/bc55b012-e92d-47c3-bf36-6bdd6ee65643/
SH256 hash:
28a2f06c05fc57ff938deaf782e23986962785e947fb7922454779d33b0c9a84
MD5 hash:
d5c0d9e9b7ab82909616db51853f52fb
SHA1 hash:
260d62353d3d57326b9e88bfc61384d47d2ed58d
Detections:
win_redline_wextract_hunting_oct_2023
Create hunting rule
Link:
https://www.unpac.me/results/bc55b012-e92d-47c3-bf36-6bdd6ee65643/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28a2f06c05fc57ff938deaf782e23986962785e947fb7922454779d33b0c9a84

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 28a2f06c05fc57ff938deaf782e23986962785e947fb7922454779d33b0c9a84

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2738241/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/468474/

Comments