MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae
SHA3-384 hash: 7e89c233e1bda68b8d081250605fb2c35a352f5da22609e6483d2f93ba71592daa3f420f045a0456eb8463f47e62ae6d
SHA1 hash: 1dca7d7217948e39dcd3b71c6b4b4643179ce894
MD5 hash: 0fc0a2480773a672b3c930f68d40b7a3
humanhash: maryland-jersey-bulldog-one
File name:0fc0a2480773a672b3c930f68d40b7a3.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:301'056 bytes
First seen:2024-04-23 03:05:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f8d33b9f09a43bf6ac79dbad3d851acc (1 x Stealc)
ssdeep 3072:a9GuVS0toSMv9sop7EyV45r7cN28RPhPMmzc+55l6iwrwLSXOG6Hal:TuVSNSMeopIG45X+pPXzJFcMS5
TLSH T1BB549C0176A0DC32FD5A77398A29C6E4162AFD715FB4A68F7284375F19B33A0A532313
TrID 67.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.2% (.EXE) Win64 Executable (generic) (10523/12/4)
5.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.2% (.EXE) Win32 Executable (generic) (4504/4/1)
2.4% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon 64d29a9889a98991 (4 x Stealc)
Reporter abuse_ch
Tags:exe Stealc


Avatar
abuse_ch
Stealc C2:
http://185.172.128.111/f993692117a3fda2.php

Intelligence

File Origin
# of uploads :
1
# of downloads :
311
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae.exe
Verdict:
Malicious activity
Analysis date:
2024-04-23 03:37:46 UTC
Tags:
stealer stealc
Link:
https://app.any.run/tasks/3151c854-a526-4de3-879e-04173d6c114f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Connecting to a non-recommended domain
Connection attempt
Sending an HTTP GET request
Running batch commands
Creating a process with a hidden window
Launching a process
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/162257e7-ab9a-49db-a4e5-26fe1de7d02f
Result
Threat name:
Mars Stealer, Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1430074
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Snort IDS alert for network traffic
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Mars stealer
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2024-04-23 00:04:09 UTC
File Type:
PE (Exe)
Extracted files:
37
AV detection:
16 of 24 (66.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jt5xlcdnmlbqh4r2yh22e7pbvmed4blnfjeyvlaqjoy6rh5lhsxa._file
Verdict:
malicious
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc stealer
Link:
https://tria.ge/reports/240423-dlqyyscc41/
Behaviour
Program crash
Stealc
Unpacked files
SH256 hash:
743875dcc496b10bc3b30df93f050fc7660b19a0125046769fcb5eb9166d62b9
MD5 hash:
3d508dd52445d80003ea8f82924983ed
SHA1 hash:
87573bf07f77149fd531082018f784992b183795
Detections:
stealc
Create hunting rule
win_stealc_auto
Create hunting rule
Link:
https://www.unpac.me/results/c20eae9b-f0aa-4689-b7a4-0ed20c3eff61/
Parent samples :
1a102b793f4cad2e1bffc0a7e25ffd3601744a616d19f7f5dbd57c8a116538b3
9bef7a636bd52f5ecd74c1f4041c73eefad5e23f8a978af0201f72cd24a9b0d0
fb63921ce0bda58d6277755b5e784e7b042f646d64ebbd230a6b9b8ab3db33d7
a4805aa4e8b2cb5956f757d210eaa3cd8d14b9f882f483473b1c5cc9c64c441d
1418981255cd087e37c0995615e09d0e969a1adafc29f7995156e0b1d4c40285
6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891
d5dbffe347a31cc50559e0c91f94f47fa1f134d3678c7721685af1bdf84be133
2daf90fbe9e99b9e0378f48a8b091fa703b735760ebf32ce609b40d4648a955e
8d8e0734ba1d608ef6ee124b1d5ab196223f6eb1d50348d1eb0b6ae57cd8ad3a
4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae
0a6e0a8505b349359dc63cc92fc46f879f19f43c246eb7e2445dcaca526d70fb
4d8b8c49b376c483e08d172646b49baf697d54b815b8357008117fed39c92cb0
c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0
cb664fc08a69a03e1d7ad2d47b9d7397330601fcfd8d559149ee606d782f14ad
dadc6e78d7628c9b004c60834d4f20729bf6718b972c31ef08c3bb7181a39a7f
6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8
a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3
1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f
SH256 hash:
4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae
MD5 hash:
0fc0a2480773a672b3c930f68d40b7a3
SHA1 hash:
1dca7d7217948e39dcd3b71c6b4b4643179ce894
Link:
https://www.unpac.me/results/c20eae9b-f0aa-4689-b7a4-0ed20c3eff61/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4cfb75886d62/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2754939/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2810818/
  
URLhaus
https://urlhaus.abuse.ch/url/2812849/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::FindNextVolumeW
KERNEL32.dll::SetFirmwareEnvironmentVariableW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetVolumeInformationW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleA
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetConsoleDisplayMode
KERNEL32.dll::SetConsoleTitleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleAliasExesLengthA
KERNEL32.dll::GetConsoleAliasesLengthA
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW

Comments