MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ee6df6d3cfbce9324fc34379e0772695ce4ede14734153b12eb51516b94d76f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 18

Intelligence 18 IOCs 1 YARA 2 File information Comments 1

SHA256 hash:	2ee6df6d3cfbce9324fc34379e0772695ce4ede14734153b12eb51516b94d76f
SHA3-384 hash:	dfdce498b495ad64609192f7d0924ffb552d239557e6c6cd7c5cb86bc5f3f1a707b954d21e26816535e45514de3ffa35
SHA1 hash:	39cf1082bbcc1df1a459decdea01dc3abb3da015
MD5 hash:	6e819c35beb85f8705f0792c993630d1
humanhash:	timing-happy-utah-sad
File name:	6e819c35beb85f8705f0792c993630d1
Download:	download sample
Signature	Stealc Create hunting rule
File size:	404'480 bytes
First seen:	2024-10-27 04:53:55 UTC
Last seen:	2024-10-27 06:24:10 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	96da14c459da31df021f55f915660fbc (1 x Stealc)
ssdeep	6144:VkXoyphiWw2E7jZRlWMi/0nD+Qo7onlnro:EohrFWB/0nDpo7An
TLSH	T1E1847CD12DF16812EEB76B314D3B86ECDA6BBC52DEB8525D6110FE0F08723B09652712
TrID	35.9% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 26.9% (.EXE) InstallShield setup (43053/19/16) 19.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 6.5% (.EXE) Win64 Executable (generic) (10522/11/4) 3.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
File icon (PE):
dhash icon	000822430c110400 (1 x Stealc)
Reporter	zbetcheckin
Tags:	32 exe Stealc

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://194.15.46.65/7f031eb0d257b290.php	https://threatfox.abuse.ch/ioc/1339564/

Intelligence

File Origin

# of uploads :

# of downloads :

404

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

6e819c35beb85f8705f0792c993630d1.exe

Verdict:

Malicious activity

Analysis date:

2024-10-27 04:58:00 UTC

Tags:

stealer stealc loader

Link:

https://app.any.run/tasks/0c6f8962-065b-4584-8f38-7cea91dd70db

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.17764.9040.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=671dc951a75e41aa672218ff

Tags:

Cobalt Lien

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending an HTTP GET request

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

exploit fingerprint microsoft_visual_cc packed packed packer_detected

Link:

https://www.filescan.io/uploads/671dc76d73a3c7da80f3715e/reports/31ca1502-7a5c-4c49-9d4b-b346116fe74e/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/2ee6df6d3cfbce9324fc34379e0772695ce4ede14734153b12eb51516b94d76f

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/78c1abf9-a46b-4349-883e-94aaf0026f64

Result

Threat name:

Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1543040

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Searches for specific processes (likely to inject)

Suricata IDS alerts for network traffic

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/2ee6df6d3cfbce9324fc34379e0772695ce4ede14734153b12eb51516b94d76f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2ee6df6d3cfbce9324fc34379e0772695ce4ede14734153b12eb51516b94d76f/

Threat name:

Win32.Trojan.Vidar

Status:

Malicious

First seen:

2024-10-27 04:54:11 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=f3tn63j47phjgjh4gq3z4b3snfooj3pbi42bkoys5nivc24u25xq._file

Verdict:

malicious

Label(s):

stealc

shellcode_loader_002

Similar samples:

error

Stealc

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc botnet:logsdiller credential_access discovery evasion spyware stealer themida trojan

Link:

https://tria.ge/reports/241027-fjjszasldv/

Behaviour

Checks processor information in registry

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Themida packer

Unsecured Credentials: Credentials In Files

Downloads MZ/PE file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Stealc

Stealc family

Malware Config

C2 Extraction:

http://194.15.46.65

Verdict:

Malicious

Tags:

stealc

YARA:

n/a

Link:

https://app.threat.zone/submission/867b3751-c4eb-46b8-9d4b-38503d2f1bcb

Unpacked files

SH256 hash:

1c3199a7e3bd6da6647a260d168700d456402a9d751bc26b5a8e1874a035298b

MD5 hash:

4c4090ccdf8d3ec03a3dc73b98c19a06

SHA1 hash:

a1dc5e1b4e2099d86024a9be181d2208483182c4

Detections:

stealc

detect_Mars_Stealer

Link:

https://www.unpac.me/results/5831a2b5-19d4-4b3e-92e0-93c9d2468bb5/

Parent samples :

2ee6df6d3cfbce9324fc34379e0772695ce4ede14734153b12eb51516b94d76f
925c5c0d232f0b735e1eb0823890fe8b40c01d93f976a58ec605f36997c25079

SH256 hash:

29e7e1c1e1a7e5f26f6961d8036cdd04ee4557dec0a7dcadcd8e7651f5e53f43

MD5 hash:

2ec23e83e2f63ab27c25741b1f4d7f49

SHA1 hash:

bb231b274bd66393fa830a44e6d4447d4399eeb9

Link:

https://www.unpac.me/results/5831a2b5-19d4-4b3e-92e0-93c9d2468bb5/

SH256 hash:

2ee6df6d3cfbce9324fc34379e0772695ce4ede14734153b12eb51516b94d76f

MD5 hash:

6e819c35beb85f8705f0792c993630d1

SHA1 hash:

39cf1082bbcc1df1a459decdea01dc3abb3da015

Link:

https://www.unpac.me/results/5831a2b5-19d4-4b3e-92e0-93c9d2468bb5/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2ee6df6d3cfb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2ee6df6d3cfbce9324fc34379e0772695ce4ede14734153b12eb51516b94d76f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 2ee6df6d3cfbce9324fc34379e0772695ce4ede14734153b12eb51516b94d76f

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3255309/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::DeleteVolumeMountPointA KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleA KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleOutputCharacterW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleAliasW KERNEL32.dll::GetConsoleFontSize KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateFileA KERNEL32.dll::MoveFileExW KERNEL32.dll::MoveFileA KERNEL32.dll::GetFileAttributesW KERNEL32.dll::GetSystemWow64DirectoryW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameA
WIN_HTTP_API	Uses HTTP services	WINHTTP.dll::WinHttpOpenRequest

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-10-27 04:53:56 UTC

url : hxxps://sirault.be/cryyy.exe