MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 393ae8b74a57f267e4b311d653fffc8f93b2fcf5a8046303c26d5cced6b3b83e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 18


Intelligence 18 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 393ae8b74a57f267e4b311d653fffc8f93b2fcf5a8046303c26d5cced6b3b83e
SHA3-384 hash: 7492ee2700be294c4606b5c4590f80fe468d8c033c1169334bb4b97d5bd464fbe0a056f386d21d0042b58beee58d57ba
SHA1 hash: 12da0c22dc5df6c5a3c578ba91e2bcb28b11bdba
MD5 hash: 1c8b10e3c092a92edabcedfacb862d22
humanhash: steak-freddie-two-thirteen
File name:1c8b10e3c092a92edabcedfacb862d22.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:402'432 bytes
First seen:2024-10-01 21:50:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bb1aa3c63950bdbf555ab252155eee8b (1 x Stealc)
ssdeep 6144:39xhGiHIDil71UyrRK8/0wQa+njNrJ7a8nPk/RhsKhXzE:NG5Dil7NKMQa+BrJ7PnmRh7D
TLSH T19584B00262F5EC60E76246318E2EC7F46EEEFC614D5766EB33586A6F18B03A1C562701
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.9% (.EXE) Win32 Executable (generic) (4504/4/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon 183268c0c2c8c000 (1 x Stealc)
Reporter abuse_ch
Tags:exe Stealc


Avatar
abuse_ch
Stealc C2:
http://194.26.232.100/d9355d18f49536e4.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://194.26.232.100/d9355d18f49536e4.php https://threatfox.abuse.ch/ioc/1332584/

Intelligence

File Origin
# of uploads :
1
# of downloads :
520
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1c8b10e3c092a92edabcedfacb862d22.exe
Verdict:
Malicious activity
Analysis date:
2024-10-01 21:53:29 UTC
Tags:
stealer stealc
Link:
https://app.any.run/tasks/86064192-d89a-4934-abd7-3815d15e9257

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66fc6ec70fdf888709797abe
Tags:
Powershell Cobalt Lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Connection attempt
Sending an HTTP GET request
Running batch commands
Creating a process with a hidden window
Launching a process
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc fingerprint microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/66fc6ece718049dcaee540fe/reports/432cbd40-73bb-4e88-8968-b3cfe4d32226/overview
Verdict:
Malicious
Labled as:
Midie.Generic
Link:
https://www.hybrid-analysis.com/sample/393ae8b74a57f267e4b311d653fffc8f93b2fcf5a8046303c26d5cced6b3b83e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d3da963a-4e34-4938-bee8-7c2167a8d50e
Result
Threat name:
Stealc
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1523696
Signature
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Searches for specific processes (likely to inject)
Self deletion via cmd or bat file
Suricata IDS alerts for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal ftp login credentials
Yara detected Powershell download and execute
Yara detected Stealc
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1523696 Sample: exrRzW2s08.exe Startdate: 01/10/2024 Architecture: WINDOWS Score: 100 24 Suricata IDS alerts for network traffic 2->24 26 Found malware configuration 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 6 other signatures 2->30 7 exrRzW2s08.exe 14 2->7         started        process3 dnsIp4 22 194.26.232.100, 49730, 80 HEANETIE Netherlands 7->22 32 Detected unpacking (changes PE section rights) 7->32 34 Detected unpacking (overwrites its own PE header) 7->34 36 Self deletion via cmd or bat file 7->36 38 4 other signatures 7->38 11 WerFault.exe 21 16 7->11         started        14 cmd.exe 1 7->14         started        signatures5 process6 file7 20 C:\ProgramData\Microsoft\...\Report.wer, Unicode 11->20 dropped 16 conhost.exe 14->16         started        18 timeout.exe 1 14->18         started        process8
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/393ae8b74a57f267e4b311d653fffc8f93b2fcf5a8046303c26d5cced6b3b83e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/393ae8b74a57f267e4b311d653fffc8f93b2fcf5a8046303c26d5cced6b3b83e/
Threat name:
Win32.Spyware.Marsstealer
Create hunting rule
Status:
Malicious
First seen:
2024-09-29 04:25:19 UTC
File Type:
PE (Exe)
Extracted files:
49
AV detection:
22 of 24 (91.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=he5orn2kk7zgpzftchlfh774r6j3f7hvvacgga6cnvom5vvtxa7a._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
shellcode_loader_002
Create hunting rule
Similar samples:
error
Stealc
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:logsdiller credential_access discovery spyware stealer
Link:
https://tria.ge/reports/241001-1qf1wawbre/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Checks installed software on the system
Checks computer location settings
Deletes itself
Reads data files stored by FTP clients
Unsecured Credentials: Credentials In Files
Stealc
Malware Config
C2 Extraction:
http://194.26.232.100
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1df5b6aa-d404-4692-98a2-9b54af136c00
Unpacked files
SH256 hash:
4959bc97189baacc359543fdffc13f1b64a4aeb2a3d6de714b18eebdf008ac61
MD5 hash:
6b22b7152243e7222f04e136b71c1fd0
SHA1 hash:
8b8a8c426944c54fe91d3a0c174ef6c6968f13a9
Detections:
stealc
Create hunting rule
Link:
https://www.unpac.me/results/413be261-9a25-4e6a-b87a-a53df02b8e45/
SH256 hash:
3986363fb8deb6927a153051c4d412001481d4cb60a113261c0e0402238bfef9
MD5 hash:
f5aa858b2cbbb784ca62b8891c9f557e
SHA1 hash:
f45f07667a035a43b06a5f43755e249a67a01f67
Link:
https://www.unpac.me/results/413be261-9a25-4e6a-b87a-a53df02b8e45/
SH256 hash:
393ae8b74a57f267e4b311d653fffc8f93b2fcf5a8046303c26d5cced6b3b83e
MD5 hash:
1c8b10e3c092a92edabcedfacb862d22
SHA1 hash:
12da0c22dc5df6c5a3c578ba91e2bcb28b11bdba
Link:
https://www.unpac.me/results/413be261-9a25-4e6a-b87a-a53df02b8e45/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/393ae8b74a57/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/393ae8b74a57f267e4b311d653fffc8f93b2fcf5a8046303c26d5cced6b3b83e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_Malicious_VBScript_Base64
Create hunting rule
Author:daniyyell
Description:Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::SetProcessShutdownParameters
WINHTTP.dll::WinHttpCloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetDiskFreeSpaceExA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::ReadConsoleInputA
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleAliasExesW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateHardLinkA
KERNEL32.dll::MoveFileW
KERNEL32.dll::GetWindowsDirectoryW
KERNEL32.dll::GetFileAttributesW
KERNEL32.dll::SetVolumeMountPointW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::QueryDosDeviceW

Comments