🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b7dbba7689d6c299e1bb956a0a7ea21b457f523c25f67a3b39c5ddef8ea2543. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 13


Intelligence 13 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2b7dbba7689d6c299e1bb956a0a7ea21b457f523c25f67a3b39c5ddef8ea2543
SHA3-384 hash: dcd84c77ddd746f2cba2326bfac460d7a7982b664feb5dadb4e53400abb135e5dfc9d5771a87a428b53d1566b0aef720
SHA1 hash: 7360fcfbf857c151f23ce283cba6d268fade0a1f
MD5 hash: 1a4b49379f3da71c8d7d828535298376
humanhash: wyoming-oranges-juliet-table
File name:1a4b49379f3da71c8d7d828535298376.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:1'634'816 bytes
First seen:2026-08-12 13:01:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:GUsAQJBp4etpi/B9RW04IunIX1qKfiHlzvS:GPqOaLvinIA7FDS
TLSH T1937522885A46EA0AC995473C0A61F7F40B784EDDE511D2076FDCBEFBB6B5E168C102C2
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe Stealc

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-08-12 13:08:21 UTC
Tags:
auto-reg stealc stealer
Link:
https://app.any.run/tasks/387215fb-63d6-4475-ac03-96574c40d06e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/80742/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Adding an exclusion to Microsoft Defender
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
formbook packed
Link:
https://www.filescan.io/uploads/6a7c6eb18bb7ee2355b0a04d/reports/566256b1-cc53-44bf-b335-5a97ab0f0f42/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/2b7dbba7689d6c299e1bb956a0a7ea21b457f523c25f67a3b39c5ddef8ea2543
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-30T04:16:00Z UTC
Last seen:
2026-08-14T11:33:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/2b7dbba7689d6c299e1bb956a0a7ea21b457f523c25f67a3b39c5ddef8ea2543/results?tab=lookup
Malware family:
KeyBase
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0e0c0515-260b-46d6-9057-15a8cffe4952
Result
Threat name:
Stealc
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1956889
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
AI detected malicious Powershell script
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Unusual module load detection (module proxying)
Yara detected Powershell decode and execute
Yara detected Stealc
Yara detected Stealc v2
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1956889 Sample: DLHbnAM4O4.exe Startdate: 12/08/2026 Architecture: WINDOWS Score: 100 50 update-microsoft-data.services 2->50 52 eip-terr-na.cdp1.digicert.com.akahost.net 2->52 54 Antivirus detection for URL or domain 2->54 56 Antivirus detection for dropped file 2->56 58 Antivirus / Scanner detection for submitted sample 2->58 60 15 other signatures 2->60 8 DLHbnAM4O4.exe 1 7 2->8         started        12 powershell.exe 19 2->12         started        14 powershell.exe 2->14         started        16 svchost.exe 1 1 2->16         started        signatures3 process4 dnsIp5 40 C:\Users\user\AppData\...\VpqZXdyEKy.exe, PE32+ 8->40 dropped 42 C:\Users\...\VpqZXdyEKy.exe:Zone.Identifier, ASCII 8->42 dropped 44 C:\Users\user\AppData\...\l0tseapino1.ps1, ASCII 8->44 dropped 46 C:\Users\user\AppData\...\DLHbnAM4O4.exe.log, CSV 8->46 dropped 76 Hijacks the control flow in another process 8->76 78 Creates autostart registry keys with suspicious values (likely registry only malware) 8->78 80 Creates an autostart registry key pointing to binary in C:\Windows 8->80 82 4 other signatures 8->82 19 powershell.exe 23 8->19         started        22 DLHbnAM4O4.exe 12 8->22         started        24 VpqZXdyEKy.exe 3 12->24         started        26 conhost.exe 12->26         started        28 VpqZXdyEKy.exe 14->28         started        30 conhost.exe 14->30         started        48 127.0.0.1 unknown unknown 16->48 file6 signatures7 process8 signatures9 62 Loading BitLocker PowerShell Module 19->62 32 WmiPrvSE.exe 19->32         started        34 conhost.exe 19->34         started        64 Antivirus detection for dropped file 24->64 66 Multi AV Scanner detection for dropped file 24->66 68 Hijacks the control flow in another process 24->68 70 Unusual module load detection (module proxying) 24->70 36 VpqZXdyEKy.exe 24->36         started        72 Modifies the context of a thread in another process (thread injection) 28->72 74 Injects a PE file into a foreign processes 28->74 38 VpqZXdyEKy.exe 28->38         started        process10
Score:
85%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2b7dbba7689d6c299e1bb956a0a7ea21b457f523c25f67a3b39c5ddef8ea2543
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.28 Win 64 Exe x64
Link:
https://app.malva.re/file/1a4b49379f3da71c8d7d828535298376
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2b7dbba7689d6c299e1bb956a0a7ea21b457f523c25f67a3b39c5ddef8ea2543/
Threat name:
Win64.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-07-30 11:05:43 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
4
AV detection:
24 of 38 (63.16%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fn63xj3itvwcthq3xflkbj7keg2fp5jdyjpwpi5ttro556hkevbq._file
Verdict:
malicious
Label(s):
StealC
Create hunting rule
shellcode_loader_007
Create hunting rule
Link:
https://reports.threatray.com/f315f7d5-317d-4dc0-9598-2496af131eb3
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution persistence
Link:
https://tria.ge/reports/260812-p9h4ssxepc/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Command and Scripting Interpreter: PowerShell
Unpacked files
SH256 hash:
2b7dbba7689d6c299e1bb956a0a7ea21b457f523c25f67a3b39c5ddef8ea2543
MD5 hash:
1a4b49379f3da71c8d7d828535298376
SHA1 hash:
7360fcfbf857c151f23ce283cba6d268fade0a1f
Link:
https://www.unpac.me/results/8af6b2ee-9ca8-4feb-a17b-9dc2c1295e62/
Malware family:
Stealc.v2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2b7dbba7689d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.49
Link:
https://yomi.yoroi.company/submissions/2b7dbba7689d6c299e1bb956a0a7ea21b457f523c25f67a3b39c5ddef8ea2543

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Heuristics_ChromeABE
Create hunting rule
Author:Still
Description:attempts to match instructions related to Chrome App-bound Encryption elevation service; possibly spotted amongst infostealers
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:StealcV2
Create hunting rule
Author:Still
Description:attempts to match the instructions found in StealcV2
Rule name:StealcV2DateCheck
Create hunting rule
Author:kevoreilly
Description:StealcV2 date check bypass
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Windows_Trojan_Stealc_41db1d4d
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Stealc_df3cdc7e
Create hunting rule
Author:Elastic Security
Rule name:win_mal_StealC_v2
Create hunting rule
Author:AlexMM
Description:Detects StealC v2
Rule name:win_stealc_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.stealc.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/80742/

Comments