MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48f63e29f5a2f7a377600e6070f3b60c36b342cc12ed34230974d39a10522c01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 16

Intelligence 16 IOCs YARA 5 File information Comments

SHA256 hash:	48f63e29f5a2f7a377600e6070f3b60c36b342cc12ed34230974d39a10522c01
SHA3-384 hash:	6a304b374777745d77caa8dc27b672a464b79636060cea47a80b3b0fbcfd57e745d4e71f110c44d2c9a8b2268e9db848
SHA1 hash:	e03b4ecb1e8e2f359ebd1e78ee0cc68cf3075d0f
MD5 hash:	f27a4cd423984e67c913698caab27dc3
humanhash:	oxygen-equal-twenty-hawaii
File name:	file
Download:	download sample
Signature	Stealc Create hunting rule
File size:	694'272 bytes
First seen:	2024-07-20 12:38:55 UTC
Last seen:	2024-07-20 14:04:57 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f4d7bc3fdef18bca35b7253afc196af9 (11 x Stealc)
ssdeep	12288:exy/v/5o7YNQ5N2K3yd9ids0JKpKyVnRszd/qjRydmKceG9QCphw:B/v6wQ5N2K3yWds0JkKyVmzdqymL6Z
Threatray	66 similar samples on MalwareBazaar
TLSH	T160E42375E027A875D63A34FA55DCE25183286C9EB14D8B3D08CF6981087C5BEE399CCB
TrID	40.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 16.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 12.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.0% (.EXE) Win32 Executable (generic) (4504/4/1) 5.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	Bitsight
Tags:	exe Stealc

Bitsight

url: http://77.91.77.81/stealc/random.exe

Intelligence

File Origin

# of uploads :

# of downloads :

514

Origin country :

Vendor Threat Intelligence

Malware family:

vidar

ID:

File name:

fecffd8f6cdd8ad950507bebbb23a146ec5252e35be146840ded98dff189cf12.zip

Verdict:

Malicious activity

Analysis date:

2024-07-20 14:02:11 UTC

Tags:

evasion privateloader discord loader risepro stealer stealc telegram vidar metastealer themida redline opendir amadey botnet tofsee lumma miner adware neoreklami socks5systemz proxy

Link:

https://app.any.run/tasks/7f1693b9-c0fe-42c4-b7b6-e72c4e46b066

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

PUA.Win.Packer.EnigmaProtector-12

PUA.Win.Packer.EnigmaProtector-5

PUA.Win.Packer.EnigmaProtector-9852682-0

Win.Malware.Tar4rkdi-6804466-0

Win.Trojan.Scar-6903585-0

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=669bafe7b302ab76f44810c2

Tags:

Infostealer Network Stealth

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a file in the %temp% directory

Connecting to a non-recommended domain

Connection attempt

Sending an HTTP GET request

Running batch commands

Creating a process with a hidden window

Launching a process

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/48f63e29f5a2f7a377600e6070f3b60c36b342cc12ed34230974d39a10522c01

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2f59846f-d655-4c6a-b270-b3ecdaec5f71

Result

Threat name:

Stealc

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1477215

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Contains functionality to detect sleep reduction / modifications

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

PE file has nameless sections

Sample uses string decryption to hide its real strings

Snort IDS alert for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/48f63e29f5a2f7a377600e6070f3b60c36b342cc12ed34230974d39a10522c01

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/48f63e29f5a2f7a377600e6070f3b60c36b342cc12ed34230974d39a10522c01/

Threat name:

Win32.Trojan.Stealerc

Status:

Malicious

First seen:

2024-07-20 12:39:06 UTC

File Type:

PE (Exe)

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jd3d4kpvul32g53abzqhb45wbq3lgqwmclwtiiyjotjzuecsfqaq._file

Verdict:

malicious

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc botnet:default stealer

Link:

https://tria.ge/reports/240720-pvlw5sygpj/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of NtSetInformationThreadHideFromDebugger

Stealc

Malware Config

C2 Extraction:

http://85.28.47.31

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/a946685a-4860-47fa-8979-ab89d1498e9c

Unpacked files

SH256 hash:

48f63e29f5a2f7a377600e6070f3b60c36b342cc12ed34230974d39a10522c01

MD5 hash:

f27a4cd423984e67c913698caab27dc3

SHA1 hash:

e03b4ecb1e8e2f359ebd1e78ee0cc68cf3075d0f

Detections:

SUSP_XORed_URL_In_EXE

Link:

https://www.unpac.me/results/39860796-7d15-4b70-a390-3d03315bae87/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/48f63e29f5a2f7a377600e6070f3b60c36b342cc12ed34230974d39a10522c01

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	EnigmaProtector1XSukhovVladimirSergeNMarkin Create hunting rule
Author:	malware-lu

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	SUSP_XORed_URL_In_EXE Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 48f63e29f5a2f7a377600e6070f3b60c36b342cc12ed34230974d39a10522c01

(this sample)

Dropped by

Amadey

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2908698/

URLhaus

https://urlhaus.abuse.ch/url/2909131/

URLhaus

https://urlhaus.abuse.ch/url/2909129/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
SHELL_API	Manipulates System Shell	shell32.dll::ShellExecuteA
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryA
WIN_BASE_IO_API	Can Create Files	version.dll::GetFileVersionInfoA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample