MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 18


Intelligence 18 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
SHA3-384 hash: 2794f65ce0e73876617db1da7b260ff72f190c2aca4349504d798e285eea044d2229c1dc351f011c25672e9784949d3a
SHA1 hash: c422ff50804e4d4e55d372b266b2b9aa02d3cfdd
MD5 hash: 607c413d4698582cc147d0f0d8ce5ef1
humanhash: asparagus-mars-two-butter
File name:607c413d4698582cc147d0f0d8ce5ef1
Download: download sample
Signature Stealc
Create hunting rule
File size:422'912 bytes
First seen:2024-08-01 04:03:04 UTC
Last seen:2024-12-18 10:34:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 95d4113c25a148a48f2688574ed71076 (3 x LummaStealer, 2 x Stealc, 1 x PureLogsStealer)
ssdeep 6144:FmliDzugxTgexyJ4hgIR3oHu5VamKRUuCjdwZOeBSGJfaoZ0HmNKP7gnF/1p0IX:m8bxcextX5UmKRUuyQOeBtJpZ8Cd
TLSH T17194E11175C1C472DA23253309E4D7BA6A7EF9704EB09E9BA7980F7FDF702C18221666
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter zbetcheckin
Tags:32 exe Stealc

Intelligence

File Origin
# of uploads :
2
# of downloads :
411
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
http://185.215.113.16/runo/sand.exe
Verdict:
Malicious activity
Analysis date:
2024-07-31 11:55:13 UTC
Tags:
amadey botnet stealer loader themida stealc antivm metastealer redline evasion telegram smokeloader miner deerstealer xfiles pyinstaller python
Link:
https://app.any.run/tasks/c232d82c-bcf2-440e-ad32-91307f9de8c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66ab0934b7a04efc74398060
Tags:
Stealc
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Сreating synchronization primitives
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Forced shutdown of a system process
Connection attempt to an infection source
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc fingerprint microsoft_visual_cc packed stealc
Link:
https://www.filescan.io/uploads/66ab09323a481e36d574843d/reports/42e3ec86-c097-4de3-861b-a41305f2d6db/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ca76a945-694a-4a8d-a401-868fed98d564
Result
Threat name:
Stealc
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1485755
Signature
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Writes to foreign memory regions
Yara detected Powershell download and execute
Yara detected Stealc
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1485755 Sample: ch4Kb2qfF2.exe Startdate: 01/08/2024 Architecture: WINDOWS Score: 100 22 15.164.165.52.in-addr.arpa 2->22 26 Multi AV Scanner detection for domain / URL 2->26 28 Found malware configuration 2->28 30 Antivirus detection for URL or domain 2->30 32 7 other signatures 2->32 8 ch4Kb2qfF2.exe 1 2->8         started        signatures3 process4 signatures5 34 Contains functionality to inject code into remote processes 8->34 36 Writes to foreign memory regions 8->36 38 Allocates memory in foreign processes 8->38 40 Injects a PE file into a foreign processes 8->40 11 RegAsm.exe 12 8->11         started        14 conhost.exe 8->14         started        16 RegAsm.exe 8->16         started        18 RegAsm.exe 8->18         started        process6 dnsIp7 24 85.28.47.70, 49730, 80 GES-ASRU Russian Federation 11->24 20 WerFault.exe 22 16 11->20         started        process8
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5/
Threat name:
Win32.Spyware.Stealc
Create hunting rule
Status:
Malicious
First seen:
2024-07-30 20:25:50 UTC
File Type:
PE (Exe)
AV detection:
24 of 24 (100.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i2uktwoghfidupemszkmdcixvhhnx3m4so5l2fhpcta6euucydkq._file
Verdict:
malicious
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:qll discovery stealer
Link:
https://tria.ge/reports/240801-emxnkavgre/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Checks installed software on the system
Stealc
Malware Config
C2 Extraction:
http://85.28.47.70
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5eb027c6-12e3-4714-adf0-4c650d7f8bfd
Unpacked files
SH256 hash:
3dd466806d4bf6e5c445a159c4a313a13a2a11621e253c84340305f8ab12fab8
MD5 hash:
f1ff36230f36d7292b279a3e1dd624f4
SHA1 hash:
2d9b1e903f5fca94e110a69a92c09a1e605bc4bf
Detections:
stealc
Create hunting rule
Link:
https://www.unpac.me/results/b60407a2-d630-44a9-9f4b-78c49e51ead8/
Parent samples :
6b19c935d0afd202d7424d7cb7e355e4c04645721176eae6e5814b7760dca5a0
6565ab8e7be0d3e8544a49cb90e79715df0120d03c187ba9443ab738ca4dca28
525a892469b4c88bf26e584ecf9a57c1f76aa9dd8e14d3a6840b73f59dbc5cf8
d695267de534c2c99ec2823acc193fdbec9f398b0f78155ae2b982457ff631aa
46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
SH256 hash:
46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
MD5 hash:
607c413d4698582cc147d0f0d8ce5ef1
SHA1 hash:
c422ff50804e4d4e55d372b266b2b9aa02d3cfdd
Link:
https://www.unpac.me/results/b60407a2-d630-44a9-9f4b-78c49e51ead8/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/46a8a9d9c639/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3081930/
  
URLhaus
https://urlhaus.abuse.ch/url/3082008/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::VirtualAllocEx
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
KERNEL32.dll::CreateThreadpoolWork
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW

Comments


Avatar
zbet commented on 2024-08-01 04:03:05 UTC

url : hxxp://185.215.113.16/inc/4434.exe