MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35df29cb2a8b584263e5ad303a6167fc85c3c119af584cdf8ef31e76d0291eba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MarsStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35df29cb2a8b584263e5ad303a6167fc85c3c119af584cdf8ef31e76d0291eba
SHA3-384 hash: 57ad79d4775639d93fac57622af9510486f28b0a47735b021725789a1dc19020e3d8a0d7c2cdc2247ff3f56f3b9ff8f6
SHA1 hash: c6eb207acfe752b141a447f5d680aac49459de4f
MD5 hash: 38402045b549d74dbdd16a1c4a56d491
humanhash: princess-tennessee-wyoming-fix
File name:SecuriteInfo.com.Win32.BotX-gen.807.29253
Download: download sample
Signature MarsStealer
Create hunting rule
File size:273'920 bytes
First seen:2023-09-15 22:38:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be971270bdc2a8fd4ff1ab41bb993dd1 (7 x Stealc, 7 x Smoke Loader, 2 x NetSupport)
ssdeep 3072:2DUX8gZsvEpiBYUtzh8mwIFJnYp5VZ26xNlJ7KRG73Sg6NxBsvP:EUXQvmiBYUtz7k3X7KRGegkBsn
Threatray 319 similar samples on MalwareBazaar
TLSH T159449F12F3E0A870D52676399E69CAE42A3EB961CF64E65733346F2F19F02E0C572351
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0008182631180800 (1 x MarsStealer)
Reporter SecuriteInfoCom
Tags:exe MarsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
218
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.BotX-gen.807.29253
Verdict:
Malicious activity
Analysis date:
2023-09-15 22:41:55 UTC
Tags:
stealc stealer
Link:
https://app.any.run/tasks/7b987416-ffeb-4bff-93dd-4f7714a490f8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/448947/
Detection(s):
SecuriteInfo.com.Win32.BotX-gen.807.29253.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware lolbin packed shell32
Link:
https://www.filescan.io/uploads/6504dd0a32ffdb7a7a073047/reports/eee02def-319a-4679-be1f-3d078b066d8a/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/35df29cb2a8b584263e5ad303a6167fc85c3c119af584cdf8ef31e76d0291eba
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8c3f13c9-4648-4dfa-acb7-0673d36ca45f
Result
Threat name:
Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1309278
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Sample uses string decryption to hide its real strings
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35df29cb2a8b584263e5ad303a6167fc85c3c119af584cdf8ef31e76d0291eba/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2023-09-15 22:39:07 UTC
File Type:
PE (Exe)
Extracted files:
37
AV detection:
19 of 23 (82.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gxpstszkrnmeey7fvuyduylh7sc4hqizv5mezx4o6mphnubjd25a._file
Verdict:
malicious
Similar samples:
3045545357b095b5e32bf2d338ec052cf035d88ec6d2ddd06ce545eaa7eea573
MarsStealer
561d0712bfdce76c6309a6d0cf1d53686077e01980952856299ceee81f880d02
MarsStealer
606d24b53caeddba0a95b703680233f07180354189e6fddd1275cf261aeede9b
MarsStealer
719fb7835d487d0614236063c966637e44681f6c1924ba4706c6d01a76fac8fe
MarsStealer
929ed67122bfd8c59cc050234fe294ea5cbd81044850588a57428d93c3038c8f
MarsStealer
97362d92be5f792fe05c5d4a4ee7e702528b5591c5152a2c5b0f59da9b5dd0fb
MarsStealer
9b2cd6f9d153ff961cfefc5a5fb538e9470fefb2ad19f516f64dc6bcea8245a8
MarsStealer
ae29d62f9d34ef946a82df09a5ec21e8a0afd0306bce4b2b1ebf8dad18b2e97e
MarsStealer
af6e8f425fcb23cf384ca01f55ed5d1eb561b7ecbfa48264ecd8b51e460953f3
MarsStealer
be6c808d95d56676eeb845ae082c950425a5048e99590ee3b888190e75cc8b8b
MarsStealer
+ 309 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc discovery spyware stealer
Link:
https://tria.ge/reports/230915-2kyjeafe8v/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Stealc
Malware Config
C2 Extraction:
http://171.22.28.221
Unpacked files
SH256 hash:
2924a3879bdb3f7fb2d742fda5b37f568e00263700da8d8f10ad79e0f174637c
MD5 hash:
b4a05acf39514baaf212ed6d63e12f6c
SHA1 hash:
7488cf7f5f65811b23f8b42c907ab9a6c98ee991
Detections:
stealc
Create hunting rule
Link:
https://www.unpac.me/results/3e38789a-9b7e-4001-8e3e-237e21710b42/
Parent samples :
8a73b841f8c01a43987ba35ed668896b4787efc87883f5fad1b510be4a96accc
891daaeaed0ec160ca3c06fd3a5a896b776bc22a7f42cb9cb02afb49b989d4ed
af80546c5f00315fe63e7ccf8814ebffc7cd58a7c59a6896e0666ba1e45bbc37
d79d2e9a5ac4b9ca988a7c4a9f89596254fb2e2ce4822a0cdcff19c512fc496e
f05d4b948c42de713d7cfd2f9d4ea06135fa3fbf768cef463aebe4bf6d32086b
9c2da80a3de701401d4fd881f4983ecf110468a3edb59bdc30a7e1c5106753d4
929ed67122bfd8c59cc050234fe294ea5cbd81044850588a57428d93c3038c8f
606d24b53caeddba0a95b703680233f07180354189e6fddd1275cf261aeede9b
ae29d62f9d34ef946a82df09a5ec21e8a0afd0306bce4b2b1ebf8dad18b2e97e
3045545357b095b5e32bf2d338ec052cf035d88ec6d2ddd06ce545eaa7eea573
be6c808d95d56676eeb845ae082c950425a5048e99590ee3b888190e75cc8b8b
35df29cb2a8b584263e5ad303a6167fc85c3c119af584cdf8ef31e76d0291eba
7ec096310d5bb659d723caf4818b036b65d334bcdf791f6ce0c4e42c8e3ecc41
2fdcf826f3200f1f19ae9468932cce1c9afb202388d9eaf57348c01bdcdccc95
2eda9334a272c1f3e49670787c60648afd3457635beae1148007b05c61e40ac8
3f92824961eb95e3a9fa8e84179e819f5894e5510a6355ed38f97c8b1a2622c8
e186ed43e1389cd0dc5b184593f490fce469594db170576cd134870e700671bc
d2fbbfffd5b5bc517a7bec449d08eaad66d462e515864b08edcb6f9014c8f364
958b35fe0c4767aa615bd25c76477875ed1891bd4ca05c8465a1602ee55283a9
bc7bc2e78ad0bbb1be1f4c60f7cc6f2ed639c9d1f6a9a42f6f1497e6a083708b
eca8f5d25f650cab4032c7aec6c629efa5cf886ff41130acec5cc4c29446a478
4c05ab8d8ad1fc8528b9faab9f3bf2038c4ecd90c831dcbc724af4fe60086aea
f36497550dfecfee3505c7176924a1afe8b49b628e2bca2441e6e0ffcb2b7899
596461203897b81f323698f038b2cb5a124e246e9b514fdded546efc9e336882
SH256 hash:
35df29cb2a8b584263e5ad303a6167fc85c3c119af584cdf8ef31e76d0291eba
MD5 hash:
38402045b549d74dbdd16a1c4a56d491
SHA1 hash:
c6eb207acfe752b141a447f5d680aac49459de4f
Link:
https://www.unpac.me/results/3e38789a-9b7e-4001-8e3e-237e21710b42/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/35df29cb2a8b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/35df29cb2a8b584263e5ad303a6167fc85c3c119af584cdf8ef31e76d0291eba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:detect_Mars_Stealer
Create hunting rule
Author:@malgamy12
Description:detect_Mars_Stealer
Rule name:infostealer_win_stealc_standalone
Create hunting rule
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:win_stealc_w0
Create hunting rule
Author:crep1x
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MarsStealer

Executable exe 35df29cb2a8b584263e5ad303a6167fc85c3c119af584cdf8ef31e76d0291eba

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2711749/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/448947/

Comments