MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cfc6fe46f2025a7aeab3dbb5d271c49cb3341545313582ab6603351e75ee19c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 17

Intelligence 17 IOCs 1 YARA 2 File information Comments

SHA256 hash:	2cfc6fe46f2025a7aeab3dbb5d271c49cb3341545313582ab6603351e75ee19c
SHA3-384 hash:	6b384815d9352096db1f88d3d3a8b76e18154637513a6281fc46a1478478a07a461df93685c3f63185e0087a17bf5b3c
SHA1 hash:	a5614935d6be327061956c1d922c0f44720fa810
MD5 hash:	8fbbc8324dd8606d4e385bd7be40a15a
humanhash:	music-paris-three-kentucky
File name:	8fbbc8324dd8606d4e385bd7be40a15a.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	377'856 bytes
First seen:	2024-10-19 22:35:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4ad34f34e48d693450753fb0720aafe7 (1 x Stealc)
ssdeep	6144:rxMZLUZeCOmxOB/R4jlmto0nLOPWgWe/AFe:rxqYZeO4QoLOP6
Threatray	2'748 similar samples on MalwareBazaar
TLSH	T17A84E1113680C872C69291304831D7F5EABFFD7259A4948B77543F6E2E702C2AB7A35B
TrID	46.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 25.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 8.5% (.EXE) Win64 Executable (generic) (10522/11/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
File icon (PE):
dhash icon	90c6eebeb69e86c0 (1 x Stealc)
Reporter	abuse_ch
Tags:	exe Stealc

abuse_ch

Stealc C2:
http://45.88.76.205/30f6901d21ae0dd7.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://45.88.76.205/30f6901d21ae0dd7.php	https://threatfox.abuse.ch/ioc/1338225/

Intelligence

File Origin

# of uploads :

# of downloads :

419

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

8fbbc8324dd8606d4e385bd7be40a15a.exe

Verdict:

Malicious activity

Analysis date:

2024-10-19 22:46:03 UTC

Tags:

loader smokeloader

Link:

https://app.any.run/tasks/9692070d-cc4b-4f14-bc83-58d2b2dda4ae

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Enabling the 'hidden' option for recently created files

DNS request

Searching for the window

Сreating synchronization primitives

Creating a file in the %AppData% directory

Query of malicious DNS domain

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/67143452cb929da7ec4dc374/reports/a73dfa27-d5d6-4074-a08f-acaa7a67125d/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/2cfc6fe46f2025a7aeab3dbb5d271c49cb3341545313582ab6603351e75ee19c

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c5b6df48-c7ff-4785-9d78-605f2b4af3a4

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1537973

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/2cfc6fe46f2025a7aeab3dbb5d271c49cb3341545313582ab6603351e75ee19c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2cfc6fe46f2025a7aeab3dbb5d271c49cb3341545313582ab6603351e75ee19c/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2024-10-19 19:26:35 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 38 (65.79%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ft6g7zdpeas2plvlhw5v2jy4jhftgqkukmjvqkvwmazvdz264goa._file

Verdict:

malicious

Label(s):

shellcode_loader_002

smokeloader

Stealc

02eb002f33af51183396e8406bc7518c01c4b2f3b326d227fef6bc7e3c8fd1a6

Stealc

2cfc6fe46f2025a7aeab3dbb5d271c49cb3341545313582ab6603351e75ee19c

Stealc

50ca2730d4feb93b8d6cf986a86b34912d83c10dd7d7259d3538d415c904af73

Stealc

5e76223b4ec53240790dbdb1a2937774f48094711ee0cf2a5906ffd8e727e519

Stealc

df6df345690b11a2fa15db713d36614a603af22e68d8b85bd7b663aaa48bf48e

Stealc

error

Stealc

f518307808486c2718cd6b83e4e5f012e3531c8d352abd6d51b7311fcfa2c28c

Stealc

f662b3ef913a9bfb62cb970e6f8f8e81ad75b21deaccffc01cbc1390f34e776e

Stealc

+ 2'738 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:pub1 backdoor discovery trojan

Link:

https://tria.ge/reports/241019-2h8llavfrl/

Behaviour

Checks SCSI registry key(s)

Program crash

System Location Discovery: System Language Discovery

SmokeLoader

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/9f9b13c9-e3a9-4eb7-ac72-8fdc70790c4c

Unpacked files

SH256 hash:

aaf66610fa41dbdb7274c274954d697a0e81e83e677bf3b58102222c291b6949

MD5 hash:

2577ec6102eea4a1af020833990069fc

SHA1 hash:

7aa9cfbe30c72c855887931ed217e576dc70b284

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/26fdc375-877c-4a80-9334-9ffb043fcb0f/

Parent samples :

5d2e0f8cc9eb2b09f11c0e90303eafd9bf4593426cdc0bc649e074a1ad913247
75710e4a218440b1e9e330f231cfca45d5f7c41eacf9a7bd45bfd06042b79eac
71e552270361997f7b42b4ffa227ebd6a791948bfed757e61f2c3c7390bacaa3
0cf8ad6b4b1a25137fb42e0d831386e514620c851f782e37ebbd0d68105eb3d1
c4139579bd2c09fa3f876c15b04be33bd25e5c524fb687557771a07e99e22b9c
af1cd06ae9d17e6d05909d5031a72788989cb3980e7a456011091fc3ac77a07f
62469fe28764545471f447f88db812a162e9fe0af09f93b343c192a306600743
27ef27b61120a709590570f7fa86aa018f2e9b143bf97c4734720d2096b0bdf6
df6df345690b11a2fa15db713d36614a603af22e68d8b85bd7b663aaa48bf48e
2cfc6fe46f2025a7aeab3dbb5d271c49cb3341545313582ab6603351e75ee19c

SH256 hash:

2cfc6fe46f2025a7aeab3dbb5d271c49cb3341545313582ab6603351e75ee19c

MD5 hash:

8fbbc8324dd8606d4e385bd7be40a15a

SHA1 hash:

a5614935d6be327061956c1d922c0f44720fa810

Link:

https://www.unpac.me/results/26fdc375-877c-4a80-9334-9ffb043fcb0f/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2cfc6fe46f20/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2cfc6fe46f2025a7aeab3dbb5d271c49cb3341545313582ab6603351e75ee19c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 2cfc6fe46f2025a7aeab3dbb5d271c49cb3341545313582ab6603351e75ee19c

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3192422/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetDiskFreeSpaceExA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleA KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleInputA KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleAliasExesA KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA KERNEL32.dll::GetFileAttributesW KERNEL32.dll::GetTempFileNameA KERNEL32.dll::SetVolumeMountPointA
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample