MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 16


Intelligence 16 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8
SHA3-384 hash: 880f872967baccf4d0a26346f403570e7516774bc9805ec32108cc6fe46181d9d8e2d7b6fbc55606ea8049fbce9435e8
SHA1 hash: 53ae43cd779a9d0b22d5bd93668e953f98012883
MD5 hash: a46fd829228b24ce9b6d2160f84f2378
humanhash: king-freddie-charlie-two
File name:468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8
Download: download sample
Signature Stealc
Create hunting rule
File size:760'832 bytes
First seen:2025-09-25 17:35:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 112f19f28f55f461c3d7ad7d3898dd7b (27 x Stealc)
ssdeep 12288:ewVOm41h6aMIChNqge8bNqDVqlPjzad0HDKaMeY6ReOSoE/:e2eMBThN9eiyVqlPjzU0j3M7
Threatray 99 similar samples on MalwareBazaar
TLSH T15EF48D1FE7E501F8C4BB8278C9665952E77A74561370E68F03E009A63F2B6509F7EB20
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter JAMESWT_WT
Tags:93-152-230-54 exe Stealc

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8
Verdict:
Malicious activity
Analysis date:
2025-09-25 17:37:04 UTC
Tags:
stealc stealer
Link:
https://app.any.run/tasks/a0e4de89-c8e4-46b6-94ec-9428a59d936e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Stealc
Create hunting rule
Link:
https://www.capesandbox.com/analysis/29074/
Detection(s):
Win.Malware.Marte-10045369-0
Create hunting rule

ditekSHen.INDICATOR.Packed.TriumphLoader.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68d57db41e4783989051f8cd
Tags:
shellcode packed virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Connection attempt
Sending an HTTP POST request
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cmd fingerprint lolbin microsoft_visual_cc obfuscated stealc threat
Link:
https://www.filescan.io/uploads/68d57db8674d5fd6aa0cb4f8/reports/25520fbe-0311-47f8-8930-b7a638c69895/overview
Verdict:
Malicious
Labled as:
Shellcode.Loader.Marte.X.Generic
Link:
https://www.hybrid-analysis.com/sample/468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-09-17T23:49:00Z UTC
Last seen:
2025-09-17T23:49:00Z UTC
Hits:
~10
Detections:
Trojan-PSW.Lumma.HTTP.C&C Trojan-PSW.Win32.StealC.v2
Link:
https://opentip.kaspersky.com/468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/cd84df20-37f9-4f18-93f9-31cf601f92ee
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/a46fd829228b24ce9b6d2160f84f2378
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8/
Verdict:
Malicious
Threat:
Family.STEALC
Link:
https://tip.neiki.dev/file/468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8
Threat name:
Win64.Trojan.StealC
Create hunting rule
Status:
Malicious
First seen:
2025-09-18 04:37:40 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
30 of 38 (78.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i2frupiwhsish74cll2jnzbmyknhzdjp2y55kwj7iepsefimo3ea._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
Similar samples:
147f53672d406247026a5e5f89d3b92eeb105bc4271f4c2960a55e10ff26d3b1
Stealc
39ff969553fc1bb48c6aac9e81eb95a2f565f9281ec7a0ece09363d558f65ca1
Stealc
468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8
Stealc
6b1a8a5fced3fa366a2a2675db5d8769017e32bd971f19685b9f0bfa71317034
Stealc
6e7ccf904c2f005c0a2f532c922819ba751d38ec97043d6aa9c9bd08e02b505d
Stealc
929202027b6a2bebd975aaee9753a35f4d6ee5360e9af9100003a825b92febb6
Stealc
93ef9fe8bed1061e8fe615bd1ac409f3e9a1eab0088475a666f2fe31acdb398b
Stealc
b18cd8298c426e65a3cfa5039f3ff7352aefdfe7e39e26f68882f50962fe9ad3
Stealc
e71791df2374d47d1aaef8ea6af385af8d79ac1f63a28a2404b60e906fee2dab
Stealc
error
Stealc
+ 89 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:newblat
Link:
https://tria.ge/reports/250925-v6jh2sttct/
Malware Config
C2 Extraction:
http://93.152.230.54
Verdict:
Malicious
Tags:
Win.Malware.Marte-10045369-0
YARA:
n/a
Link:
https://app.threat.zone/submission/159f3948-0ebb-409a-b889-6c68a67e8a4e
Unpacked files
SH256 hash:
468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8
MD5 hash:
a46fd829228b24ce9b6d2160f84f2378
SHA1 hash:
53ae43cd779a9d0b22d5bd93668e953f98012883
Link:
https://www.unpac.me/results/fd7335ba-b1ae-4d5f-b086-d95e4306d84e/
SH256 hash:
2c4651a093a276841935a5b85856ee323d618a60d02162517c9f828c5e3e686d
MD5 hash:
fc1c04e172f708bcfdcaac1d723703bc
SHA1 hash:
12b2a6fc9e88ceba38c90d3a39e09315f1ab93a7
Link:
https://www.unpac.me/results/fd7335ba-b1ae-4d5f-b086-d95e4306d84e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:aachum_Stealcv2
Create hunting rule
Author:aachum
Description:Detects new version of Stealc.
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Heuristics_ChromeABE
Create hunting rule
Author:Still
Description:attempts to match instructions related to Chrome App-bound Encryption elevation service; possibly spotted amongst infostealers
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:StealcV2
Create hunting rule
Author:Still
Description:attempts to match the instructions found in StealcV2
Rule name:StealcV2
Create hunting rule
Author:kevoreilly
Description:Stealc V2 Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/29074/

Comments