MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d827bc28190cddf5e51c6f6183cf936f88276ff6854c2e87013902e85f9493e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 15


Intelligence 15 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d827bc28190cddf5e51c6f6183cf936f88276ff6854c2e87013902e85f9493e
SHA3-384 hash: 9afc96979193776ad6b5c10bba5c5ef1cd82eeda2aa75d1dfe334e84d656094f9e4ced002255a4a2af702ebd48689bfc
SHA1 hash: f200ea6b1574eadf38af7f23cc30f475ac4e3a2f
MD5 hash: ba4b1f7686f54035029326b69b13145c
humanhash: angel-steak-uncle-summer
File name:file
Download: download sample
Signature Stealc
Create hunting rule
File size:1'830'912 bytes
First seen:2024-11-12 09:35:07 UTC
Last seen:2024-11-12 09:39:56 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 24576:3Tq6o4789eWKNP3lZLErVdhBJnxtuNskmme7odfqnvorfh6suwifBCgOgpFStxgf:0w9ZLwxiNsWRdfqI6sHSpFSyRMG
TLSH T16985338A68C50078DC45F0B27D3113CB9E7C454698996EADDB6F01B8928F3BF79F8909
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Bitsight
Tags:exe Stealc


Avatar
Bitsight
url: http://185.215.113.16/steam/random.exe

Intelligence

File Origin
# of uploads :
5
# of downloads :
423
Origin country :
US US
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
2bfa9d9f47588b361e2d03caa473f06835544b2f00e42cc8bd4a74258c9ad8a3.exe
Verdict:
Malicious activity
Analysis date:
2024-11-12 09:26:03 UTC
Tags:
lumma stealer possible-phishing exfiltration themida loader stealc amadey botnet
Link:
https://app.any.run/tasks/6ec8328f-cea7-4c3c-8730-16337835aa3e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.9644.5575.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6733218f5496a994d660f606
Tags:
autorun spam lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Searching for the window
Running batch commands
Creating a process with a hidden window
Launching a process
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/6733218855ee3113ebe99c8d/reports/8bd428fb-0eba-4e73-8708-f7f56d91c282/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/3d827bc28190cddf5e51c6f6183cf936f88276ff6854c2e87013902e85f9493e
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/01a22512-9f46-4382-8436-9bb3c603caae
Result
Threat name:
Amadey, Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1554285
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Drops PE files to the document folder of the user
Drops PE files to the user root directory
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies windows update settings
Monitors registry run keys for changes
PE file contains section with special chars
Potentially malicious time measurement code found
Sigma detected: New RUN Key Pointing to Suspicious Folder
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Amadeys stealer DLL
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1554285 Sample: file.exe Startdate: 12/11/2024 Architecture: WINDOWS Score: 100 89 Suricata IDS alerts for network traffic 2->89 91 Found malware configuration 2->91 93 Antivirus detection for URL or domain 2->93 95 10 other signatures 2->95 8 file.exe 37 2->8         started        13 skotes.exe 2->13         started        15 skotes.exe 2->15         started        17 4 other processes 2->17 process3 dnsIp4 63 185.215.113.16 WHOLESALECONNECTIONSNL Portugal 8->63 65 185.215.113.206, 49709, 49772, 49834 WHOLESALECONNECTIONSNL Portugal 8->65 67 127.0.0.1 unknown unknown 8->67 55 C:\Users\user\DocumentsKJECFHCBKK.exe, PE32 8->55 dropped 57 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 8->57 dropped 59 C:\Users\user\AppData\...\softokn3[1].dll, PE32 8->59 dropped 61 11 other files (none is malicious) 8->61 dropped 129 Detected unpacking (changes PE section rights) 8->129 131 Attempt to bypass Chrome Application-Bound Encryption 8->131 133 Drops PE files to the document folder of the user 8->133 145 9 other signatures 8->145 19 cmd.exe 8->19         started        21 msedge.exe 2 10 8->21         started        24 chrome.exe 8->24         started        69 185.215.113.43 WHOLESALECONNECTIONSNL Portugal 13->69 135 Creates multiple autostart registry keys 13->135 137 Hides threads from debuggers 13->137 139 Tries to detect sandboxes / dynamic malware analysis system (registry check) 13->139 27 fde0e4bc1c.exe 13->27         started        29 8a46fa4b5e.exe 13->29         started        31 skotes.exe 13->31         started        141 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 15->141 71 192.168.2.16 unknown unknown 17->71 143 Maps a DLL or memory area into another process 17->143 33 msedge.exe 17->33         started        35 msedge.exe 17->35         started        37 5 other processes 17->37 file5 signatures6 process7 dnsIp8 39 DocumentsKJECFHCBKK.exe 19->39         started        43 conhost.exe 19->43         started        105 Monitors registry run keys for changes 21->105 45 msedge.exe 21->45         started        73 192.168.2.6, 443, 49704, 49706 unknown unknown 24->73 75 239.255.255.250 unknown Reserved 24->75 47 chrome.exe 24->47         started        107 Detected unpacking (changes PE section rights) 27->107 109 Tries to detect sandboxes and other dynamic analysis tools (window names) 27->109 111 Modifies windows update settings 27->111 119 4 other signatures 27->119 113 Tries to evade debugger and weak emulator (self modifying code) 29->113 115 Hides threads from debuggers 29->115 117 Tries to detect sandboxes / dynamic malware analysis system (registry check) 29->117 77 23.218.232.182 RAYA-ASEG United States 33->77 79 104.46.162.225, 443, 49926, 49963 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 33->79 81 29 other IPs or domains 33->81 signatures9 process10 dnsIp11 53 C:\Users\user\AppData\Local\...\skotes.exe, PE32 39->53 dropped 121 Detected unpacking (changes PE section rights) 39->121 123 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 39->123 125 Tries to evade debugger and weak emulator (self modifying code) 39->125 127 5 other signatures 39->127 50 skotes.exe 39->50         started        83 www.google.com 142.250.185.196, 443, 49715, 49716 GOOGLEUS United States 47->83 85 plus.l.google.com 47->85 87 2 other IPs or domains 47->87 file12 signatures13 process14 signatures15 97 Detected unpacking (changes PE section rights) 50->97 99 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 50->99 101 Tries to evade debugger and weak emulator (self modifying code) 50->101 103 3 other signatures 50->103
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/3d827bc28190cddf5e51c6f6183cf936f88276ff6854c2e87013902e85f9493e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d827bc28190cddf5e51c6f6183cf936f88276ff6854c2e87013902e85f9493e/
Threat name:
Win32.Trojan.Stealerc
Create hunting rule
Status:
Malicious
First seen:
2024-11-12 09:47:01 UTC
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hwbhxqubsdg56xsry33bqphzg34ie5x7nbkmf2dqcoic5bpzje7a._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery evasion
Link:
https://tria.ge/reports/241112-lkxdcasqak/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks BIOS information in registry
Identifies Wine through registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/aec1cf79-2479-4781-86f6-c85e5007fbc9
Unpacked files
SH256 hash:
5c60de27c45e38a5aaa0a0401ff57d13cdfe8ed99ca2980e21ee23283172b95c
MD5 hash:
320e1ba00a0954187406698aa0d4c22d
SHA1 hash:
fbef9b36c941f2afcf394ee899b80724228cda81
Detections:
win_stealc_w0
Create hunting rule
win_stealc_a0
Create hunting rule
Link:
https://www.unpac.me/results/11c8308f-78dd-4c18-9b1b-b921ddeb1fee/
SH256 hash:
3d827bc28190cddf5e51c6f6183cf936f88276ff6854c2e87013902e85f9493e
MD5 hash:
ba4b1f7686f54035029326b69b13145c
SHA1 hash:
f200ea6b1574eadf38af7f23cc30f475ac4e3a2f
Link:
https://www.unpac.me/results/11c8308f-78dd-4c18-9b1b-b921ddeb1fee/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/3d827bc28190/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d827bc28190cddf5e51c6f6183cf936f88276ff6854c2e87013902e85f9493e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 3d827bc28190cddf5e51c6f6183cf936f88276ff6854c2e87013902e85f9493e

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3279845/
  
URLhaus
https://urlhaus.abuse.ch/url/3273391/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments