MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 311d6c2eb62e8cc02df535559b319eaa62f38e6061039bf2ba68aa205fafe6f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 18


Intelligence 18 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 311d6c2eb62e8cc02df535559b319eaa62f38e6061039bf2ba68aa205fafe6f6
SHA3-384 hash: 095e9196223b05ae95588981b965be60b87151f5942caa8a1e3a0de0610df2bcb6008932b4a554e4b8d60cd1419330cf
SHA1 hash: f2a54f7f464d3980ffa374a04f19a0fb8d2a3ee6
MD5 hash: ddbad547dff32d47167ad070c3581752
humanhash: robert-chicken-lactose-red
File name:SecuriteInfo.com.Trojan.Clipper.835.18587.26551
Download: download sample
Signature Stealc
Create hunting rule
File size:1'157'120 bytes
First seen:2025-12-21 01:36:25 UTC
Last seen:2025-12-31 08:37:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 6e5b678b6d8244f4b2920ca2801b6b89 (1 x Amadey, 1 x Stealc)
ssdeep 24576:60BnZCT+b2eMBThN9eiyVqlPjzU06z3j:DK+ziFPyVSzU7z
Threatray 272 similar samples on MalwareBazaar
TLSH T185357D1FB7A501F8D4B78278C9625946E776B4560770A7CF03E006A63F2B6A09F3E721
TrID 48.7% (.EXE) Win64 Executable (generic) (10522/11/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe Stealc

Intelligence

File Origin
# of uploads :
3
# of downloads :
83
Origin country :
FR FR
Vendor Threat Intelligence
Malware configuration found for:
Stealc
Details
Stealc
decrypted strings, an RC4 key, c2 url, and url paths
Link:
https://research.acce.ciphertechsolutions.com/results/634cda29-8cf0-44ec-8902-b22e0325294b/
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Trojan.Clipper.835.18587.26551
Verdict:
Malicious activity
Analysis date:
2025-12-21 01:37:11 UTC
Tags:
stealer stealc auto-sch
Link:
https://app.any.run/tasks/3c3033c3-91b0-4f89-9198-4377e7fe2fdb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Stealc
Create hunting rule
Link:
https://www.capesandbox.com/analysis/45631/
Detection(s):
Win.Malware.Marte-10045369-0
Create hunting rule

Win.Malware.Generickdz-10058619-0
Create hunting rule

ditekSHen.INDICATOR.Packed.TriumphLoader.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69474f4a1f45795757232a6d
Tags:
autorun emotet
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm base64 clipbanker clipper cmd explorer fingerprint krypt lolbin microsoft_visual_cc schtasks stealc stealer unsafe windows
Link:
https://www.filescan.io/uploads/69474f483f8fdbf8e94d43e0/reports/44deeb25-248c-4fc9-b762-32cce3352c55/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/311d6c2eb62e8cc02df535559b319eaa62f38e6061039bf2ba68aa205fafe6f6
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-06T09:31:00Z UTC
Last seen:
2025-12-21T08:22:00Z UTC
Hits:
~100
Detections:
HEUR:HackTool.Win32.Inject.heur Trojan-PSW.Lumma.HTTP.C&C Trojan-PSW.Win64.StealC.sb Trojan-PSW.Win32.StealC.v2 HEUR:Trojan-Banker.Win32.ClipBanker.gen Trojan-Banker.Win32.ClipBanker.sb VHO:Trojan-Banker.Win32.ClipBanker.gen PDM:Trojan.Win32.Generic Trojan-Banker.Win32.ClipBanker.agdr VHO:Trojan-PSW.Win32.Stealer.gen Trojan-Dropper.Win32.Dapato.sb Trojan-Banker.Win32.ClipBanker.sba MEM:Trojan.Win32.Cometer.gen
Link:
https://opentip.kaspersky.com/311d6c2eb62e8cc02df535559b319eaa62f38e6061039bf2ba68aa205fafe6f6/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/34164ad8-f50c-443c-a38a-199e9dc7b7aa
Score:
94%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/311d6c2eb62e8cc02df535559b319eaa62f38e6061039bf2ba68aa205fafe6f6
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/ddbad547dff32d47167ad070c3581752
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/311d6c2eb62e8cc02df535559b319eaa62f38e6061039bf2ba68aa205fafe6f6/
Verdict:
Malicious
Threat:
Family.STEALC
Link:
https://tip.neiki.dev/file/311d6c2eb62e8cc02df535559b319eaa62f38e6061039bf2ba68aa205fafe6f6
Threat name:
Win64.Trojan.StealC
Create hunting rule
Status:
Malicious
First seen:
2025-12-06 14:35:28 UTC
File Type:
PE+ (Exe)
Extracted files:
6
AV detection:
25 of 36 (69.44%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=geowylvwf2gmalpvgvkzwmm6vjrphdtamebzx4v2ncvcax5p433a._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
unc_loader_073
Create hunting rule
Similar samples:
073de5edfd9496f799d5d61e818cf8b4825d51b5e6f08ac22782dc25d8d4b4a2
Stealc
2070fa49e9f8a39478e84698d46d9dc02d06463c67427f5df8e9be7c9b36282a
Stealc
28bd8714ee4bf3a45af2c991d2f44e0ea8946306722c2ee67cac40e16d1885cf
Stealc
36c1f3654cff0f52dbf25a437622ade0b2be6c6176f6b793fa5cf53d0802c335
Stealc
485c72adfc4641b73adde7c3e9c998cedb18871710aeadfe561eb7625cb6dece
Stealc
811471a5b0b641fb1f8e9e077f54f9f631022cb1f8372f2daca3323c7e7128d6
Stealc
aad0a60cb86e3a56bcd356c6559b92c4dc4a1a960f409fb499cf76c9b5409fdb
Stealc
bccc4cd8b62f4a5b7685e2c81ab2805c672850a1ab6cfbf8051e07a5b7dbc46a
Stealc
+ 262 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:bpwr botnet:xss discovery execution persistence spyware stealer
Link:
https://tria.ge/reports/251223-nzsd2swngx/
Behaviour
Checks processor information in registry
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Downloads MZ/PE file
Stealc
Stealc family
Malware Config
C2 Extraction:
http://196.251.107.23
Verdict:
Malicious
Tags:
Win.Malware.Marte-10045369-0
YARA:
n/a
Link:
https://app.threat.zone/submission/2a5c985b-8c0a-4392-af18-cf37b6528490
Unpacked files
SH256 hash:
311d6c2eb62e8cc02df535559b319eaa62f38e6061039bf2ba68aa205fafe6f6
MD5 hash:
ddbad547dff32d47167ad070c3581752
SHA1 hash:
f2a54f7f464d3980ffa374a04f19a0fb8d2a3ee6
Link:
https://www.unpac.me/results/cc4a46c3-a274-4f25-affe-6901dfb7a3f2/
SH256 hash:
c3653c2ffc439a0f3d564151a328dda51e959877a6e8ef4f74c85f9b25b3272e
MD5 hash:
9321ff2112f34eabcbf50a8301774238
SHA1 hash:
922f1dc6715643f645b5a46af6710ea49bb2a4c7
Detections:
ReflectiveLoader
Create hunting rule
INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Link:
https://www.unpac.me/results/cc4a46c3-a274-4f25-affe-6901dfb7a3f2/
SH256 hash:
6efb01fa1ffa01900acd6f39d4e05e8645a86bd6459879d8e3cdb429b1985f68
MD5 hash:
9ca59b5852f34236da292c397ab4954c
SHA1 hash:
2d6f4e0b7fb66ad85d35ae3bcf12f0d78d3829f6
Link:
https://www.unpac.me/results/cc4a46c3-a274-4f25-affe-6901dfb7a3f2/
Malware family:
Stealc.v2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/311d6c2eb62e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/311d6c2eb62e8cc02df535559b319eaa62f38e6061039bf2ba68aa205fafe6f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:aachum_Stealcv2
Create hunting rule
Author:aachum
Description:Detects new version of Stealc.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Heuristics_ChromeABE
Create hunting rule
Author:Still
Description:attempts to match instructions related to Chrome App-bound Encryption elevation service; possibly spotted amongst infostealers
Rule name:INDICATOR_SUSPICIOUS_ReflectiveLoader
Create hunting rule
Author:ditekSHen
Description:Detects Reflective DLL injection artifacts
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:ReflectiveLoader
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:Internal Research
Rule name:StealcV2
Create hunting rule
Author:Still
Description:attempts to match the instructions found in StealcV2
Rule name:StealcV2
Create hunting rule
Author:kevoreilly
Description:Stealc V2 Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 311d6c2eb62e8cc02df535559b319eaa62f38e6061039bf2ba68aa205fafe6f6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3737970/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/45631/

Comments