MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 513c3c2f07c8455f6d465bf22bfd8b11ddfc4c0ba27e231cef4d70a935162ae4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 13


Intelligence 13 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 513c3c2f07c8455f6d465bf22bfd8b11ddfc4c0ba27e231cef4d70a935162ae4
SHA3-384 hash: 612ec6889c753adb2d46b4fa3d54fba25173bf918a8722ec75ed97648c5d191546b685bab3e84638ed8377c5bbf6cbd4
SHA1 hash: 84934d112255e6f4dcf555c76f922cde6cb23cb2
MD5 hash: 89e0078eb5a4153ea077497f5a8973e7
humanhash: papa-solar-maryland-music
File name:file
Download: download sample
Signature Stealc
Create hunting rule
File size:186'368 bytes
First seen:2023-10-31 16:25:24 UTC
Last seen:2023-10-31 17:01:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0c9d3ff66162daea31cb3f02591d560a (2 x Smoke Loader, 1 x MarsStealer, 1 x Stealc)
ssdeep 3072:WUrA616dgjCk9qOGPtS+iOXgXaVBSxJggD8B8M5Akc:HA61kAh9qOGPriOXia20u8T
Threatray 124 similar samples on MalwareBazaar
TLSH T124048E8363E17CD1F8368B329F2EEBE8369EF5608E59776922585A5F04B00F1C563712
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0141290209052509 (1 x Stealc)
Reporter andretavare5
Tags:exe Stealc


Avatar
andretavare5
Sample downloaded from http://michaelcoleman.icu/timeSync.exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
362
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/457410/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Crypt.15098.14849.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/65412a9ca6fa5eab936be2e9/reports/4a8a258a-c299-438b-bc18-640218d774e2/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/513c3c2f07c8455f6d465bf22bfd8b11ddfc4c0ba27e231cef4d70a935162ae4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Oski Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/59237d57-c4f8-4153-8518-d368a7f54e99
Result
Threat name:
Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1334989
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking locale)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/513c3c2f07c8455f6d465bf22bfd8b11ddfc4c0ba27e231cef4d70a935162ae4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/513c3c2f07c8455f6d465bf22bfd8b11ddfc4c0ba27e231cef4d70a935162ae4/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-10-31 16:26:05 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
20 of 23 (86.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ke6dylyhzbcv63kglpzcx7mlcho7ytaluj7cghhpjvyksniwflsa._file
Verdict:
malicious
Similar samples:
178b12b7e4469807323da17400204b20455ebe0b63fc51cf34547540749f0adc
Stealc
1c1062e65701fdea8fa0eca0884f974b8c9e6cfe70391dfc33fcbf5594b1ebf8
Stealc
53dc29187191f04860a12fcec1d810f8c2e6b827dfc1d3c06471c6b865b96897
Stealc
54cbdd7ff4d1839f292e7cde1d17cb42d3a7d375993db9538f2cd9f6c0c68004
Stealc
6ecc47099d00f265d6d2e39174916d2812d93842b5881b056c4448fc4bcf9454
Stealc
7e04c56866f825de5621cf8074ce8235b49e7cc2bd2410ac75bbc9d1da9a5b67
Stealc
878b256c4e804c7a502d5c49c326964165c93f21e1649345eb77233b27d70631
Stealc
983f2e6c6459bc7ff4090afd1ccdb88b1784ba22dbe54e22b6f648945bfd23ca
Stealc
c40a5d39729166eb21d73335bb5e1fd55388a28f3eb9d0de6a53a290acd7d643
Stealc
e4afe296a82993d386d4619f8a91152ac7da03a2dcf52c7eaee4397796d0f32d
Stealc
+ 114 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/231031-txhdysda82/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Unpacked files
SH256 hash:
765b94af3a78c368f5008b1cf150cdbeba72412a86286a19fc6524c94c2a3498
MD5 hash:
1ec4672d437b48f8d6fe325df2726ae9
SHA1 hash:
69cd885bb9403860cc1ea11834f239290165e1ee
Detections:
stealc
Create hunting rule
Link:
https://www.unpac.me/results/05391ec8-8504-41cb-a7bf-88fdcf8e377a/
Parent samples :
178b12b7e4469807323da17400204b20455ebe0b63fc51cf34547540749f0adc
983f2e6c6459bc7ff4090afd1ccdb88b1784ba22dbe54e22b6f648945bfd23ca
e98198a357c06231c969ff6cc140143144a8ed924d708ab6e6b9bc17f6b76146
6d2a158348cbde04534fe5c28bef8d260a3ef8f9f89c31d3e46ca6d41b194970
54cbdd7ff4d1839f292e7cde1d17cb42d3a7d375993db9538f2cd9f6c0c68004
53dc29187191f04860a12fcec1d810f8c2e6b827dfc1d3c06471c6b865b96897
7202870c0d2dae977e6623e759cecc723a47f3c0de5c5138a0da0fec0a2a7e14
68d0e11261bd22cf58be2c6e0e8c7966dc4c969b08f522a63a923b8389c7cf75
6d788b9cbe3c45094ea5b283af221abe944c7bca570953da930a8649b6b7eeff
86d9471d56a6882413c72628c79b3e58350c58b6e4c2785ca3e15944aa1f9d6d
8d58024006a6c3503ba5af8f92dbdfd9178e27082491717ca1a2bdc35cf81b02
60c362f073df8d07e13eb47a3cffaf20f89caaf3a5617279deb5b14221652152
ee14c3519c9ff46b675af5ffe701e0515e6707583b11b1deb8031a99b984aa2a
7217ad57b053373c9dec1728de52487b9968616acba2be9223aaed275090be4b
4bfc364074b20dd2cc778fff6fbda1941cdbb195178ee19ee5fb3e065dd0eea9
64489e0d20826dc8ca25c85b28b4b7e6b6d85f9aa7d5500939952f358ba77592
a85528d4fcbc101d6c0fc37aad3e1859ad6e8a2556883900627f5e5f455f4f0d
fb7c402ea01a5e7329769d8b6339dff11c4f9bcba06aa9b4805804f37f46359b
e1a44604533a1b1d897da2c3263b0252043a9a5e8acc2c6d20a46e59f84e4a52
2af1996c9bdeac76c07143527a4512cabe28a9b7aba7bbf7ccf81539b05379af
ef47dd1d41c6600f29de3428794a8770aa8061a40fa98f64f2d2bd3d883f6e45
546a88deccac12d32cb3a91f1216e63753d3b221d8f20b63b455bc76f3601bec
afdcc4632e5f4bae6bec0b82c91f9dcba2918aca8c75797f7f9dea5bbdc4063f
f1ffae3fba1359eb7e6756134268ebabe97102c3674d964469a718e258ff0130
9c9306c968318a95791dee86bbc6c16f6b1d0f53b5b7d682c2a48a5c6cc1a75e
fafe7d66e5bd7b863c859d329c390978d7e2db8627664e1427f7f184ba7dc24e
64af94fc80d0295702a599ad9a8845c3a869b61ae5b41e5360c679cba6f32c2b
a26dc029cbda5105a0cb0a4a21b0f0001e6b1d957c5b5f8196cf01ea7b039d15
c45acfd6fbe8a1c5f12302fa74ff9f33dcffa172c073c9ff9c9335315382077f
591ad6570cbba766edbe7eb69c93204c2eead7a24d43860d9fae61d00264557f
63a2fa37393b054082a377b69657728756be5dbcca6c271eb80779a2bea1fb44
ed094abd877a142de3367df9ee27ee86e9807dcd4756b02c68132ff0a0d6b168
50df521fcf74817c9a42f044fa19649b3830844265e62d9ce4147a223f435de1
566bd76c6e87fc1d7c40588e4ae6277f32b80fe5829979a0467ce568bc2b25e5
80cfcd7495b811cf63d893cad16758e413256b31c61987fecf840d55c565bc43
ce7d4e42214fb2d3fd16554aabcf1b2e7e96908575ef20cd56f154918c950b5f
a217dee30587e692a690bb7dbb8a43c77deb9dcff2522930c0b0f40d76f168b1
e4afe296a82993d386d4619f8a91152ac7da03a2dcf52c7eaee4397796d0f32d
513c3c2f07c8455f6d465bf22bfd8b11ddfc4c0ba27e231cef4d70a935162ae4
5b122ee4042d6674264625bd373c46910047160fc946d3e55058269056b31638
a964494510ab39940fe01c9a1f6c5277033afe32949af8fcc49a20686bd1051e
97b63bd9ce81bc4d87fd55f6f51c95d27fca98878e346e6f5698afbf2e3a50ab
ac69894fed204b5f69601fb0e231975316fe0a09bb1b79217f722e9fffba8c5f
f84d3179e6b58dec9a4e2e862ef03a531330540e80e099f5c0d9ae54492f5e2f
f919263c6b7b515b8977d80260b204a581038a86e830203a95b671c0ab6db481
5c00aa250e356a29b7e0e558d9d4fc76dd9b2a27294e410a0a2c3153bf062e6b
c796f0643d421491278d4d27f14f6707cacaacf1c34b5c35f61d4f4f7d39c074
66467375d604cb25ddf27d225148d50f47c7f1fda23d561cc8325aaf1ff7a30f
eb54dab9a40c3f156794c2c4294e04a44e25232e32602d38882ff59057d223ca
SH256 hash:
513c3c2f07c8455f6d465bf22bfd8b11ddfc4c0ba27e231cef4d70a935162ae4
MD5 hash:
89e0078eb5a4153ea077497f5a8973e7
SHA1 hash:
84934d112255e6f4dcf555c76f922cde6cb23cb2
Link:
https://www.unpac.me/results/05391ec8-8504-41cb-a7bf-88fdcf8e377a/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/513c3c2f07c8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/513c3c2f07c8455f6d465bf22bfd8b11ddfc4c0ba27e231cef4d70a935162ae4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:detect_Mars_Stealer
Create hunting rule
Author:@malgamy12
Description:detect_Mars_Stealer
Rule name:infostealer_win_stealc_standalone
Create hunting rule
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Trojan_W32_Gh0stMiancha_1_0_0
Create hunting rule
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:win_stealc_w0
Create hunting rule
Author:crep1x
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/
Rule name:yarahub_win_stealc_bytecodes_oct_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2726689/
Cape
Cape
https://www.capesandbox.com/analysis/457410/

Comments