MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 528a04c98597c2ab37c0d9d536707c2dcd2d1f7bdc0a26fc9b24a8a3035eaf88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 528a04c98597c2ab37c0d9d536707c2dcd2d1f7bdc0a26fc9b24a8a3035eaf88
SHA3-384 hash: 0253fc3e650b2b8bab0798f9af8660ad6f3a9227f0dcbd8b6188815f0f8c45f41c3b2d6ea0e0b53513715cc7ba10c2fd
SHA1 hash: 62a245778e6459fd4b63197d8ad8e939502de479
MD5 hash: 1050aa5a1eaaa9f59f66b2e0f7702dd3
humanhash: jupiter-vermont-mexico-solar
File name:file
Download: download sample
Signature Stealc
Create hunting rule
File size:2'608'128 bytes
First seen:2023-07-28 10:50:41 UTC
Last seen:2023-07-28 11:45:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 24576:48XqeVCeRIje7mHM26hjZub/xrNOK9kI8gq1nCb+TUeraBS1iX3ozC+TQyOUJuwp:hXvIje7mijZubpcKdKunBSNLjJuwleU
Threatray 54 similar samples on MalwareBazaar
TLSH T198C5188236FE7CDCE9A9C3F0F2BFC054C624BA1D16109AAE0D591C7C5463E52BD53A89
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f0f8f0d4dcdcc4d4 (1 x Stealc)
Reporter andretavare5
Tags:exe Stealc


Avatar
andretavare5
Sample downloaded from https://amanext.com/Setup.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
285
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-07-28 10:53:47 UTC
Tags:
stealc stealer
Link:
https://app.any.run/tasks/500224f5-268f-4047-8da8-33ae1507d6cd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/435899/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.24528.8351.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Creating a file
Сreating synchronization primitives
Sending an HTTP GET request
Running batch commands
Creating a process with a hidden window
Sending a custom TCP request
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm packed
Link:
https://www.filescan.io/uploads/64c39d9880fc6008e922123a/reports/914b1c4f-60dd-4fe7-99eb-b83882381571/overview
Verdict:
Suspicious
Labled as:
MSIL_Agent.FZK.gen
Link:
https://www.hybrid-analysis.com/sample/528a04c98597c2ab37c0d9d536707c2dcd2d1f7bdc0a26fc9b24a8a3035eaf88
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Oski Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8d3d7a84-7925-4a32-8c69-d708b2856c5d
Result
Threat name:
Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1281771
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/528a04c98597c2ab37c0d9d536707c2dcd2d1f7bdc0a26fc9b24a8a3035eaf88/
Threat name:
Win32.Spyware.Stealc
Create hunting rule
Status:
Suspicious
First seen:
2023-07-28 10:51:07 UTC
File Type:
PE (.Net Exe)
Extracted files:
74
AV detection:
13 of 24 (54.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kkfajsmfs7bkwn6a3hktm4d4fxgs2h333qfcn7e3esukga26v6ea._file
Verdict:
malicious
Similar samples:
046d23bc4411e3fe3a0b2440e505a86751897f44c99d9a73bfac15b49dd9b399
Stealc
28d2d3f89f2b35af444964926c1bce39f7ae2d86e3f0864cb6028252b37fca21
Stealc
29f23979e3b541ca8955fcbd3a0f9cadbdf92c0df65ba495eeb98bd1e154bc6d
Stealc
3f76054b9bf791ef9397df1dc505e7cc8dcb87a39a2e238e71693dd0c3c3553b
Stealc
68afe1c1cef069a7386dd3a8d406d291d0da0ff654a5fc741cce02b7d54a434b
Stealc
69c49e5fef45e896b891141473eda45f8b83e29cf51fe0115c0b9806183528e7
Stealc
80de2633a99c32d2153c688a919441c977b0897358c45875b4c9834f7868e333
Stealc
d0e7a341fe199dbabb5f0798dba0564e9b60e4736a405c46eafc7232cc10dc40
Stealc
dad7e37e790b7fe49cb37bbd4947d5feac52fcf2240490b36f52ef97dc84bc4c
Stealc
e3963384741ca0ea48a1606dd175879458765e8d7f94cf64bc79725ecbd01442
Stealc
+ 44 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware
Link:
https://tria.ge/reports/230728-mxtnnada76/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Downloads MZ/PE file
Unpacked files
SH256 hash:
fd56a07f2da75c84337cbf94e0acafc09fb909cfb187a0ae214827ce2c4708bb
MD5 hash:
d93c5f59ddc41313bf36f106a2f1fe17
SHA1 hash:
97c5cd9d0689c1cd74685bc979122a13eba3fcc9
Link:
https://www.unpac.me/results/9c5431ba-0b26-456a-8429-4724a13530dd/
SH256 hash:
62ff60e791cc7bdc6ba1651b2162068b1f6fee54c0b60f8db90d49f701f7b3c8
MD5 hash:
9a676f603e3504345b297689b5aadab1
SHA1 hash:
4ac5021d532f08aa99fd9c24ab17978b43f43152
Link:
https://www.unpac.me/results/9c5431ba-0b26-456a-8429-4724a13530dd/
SH256 hash:
528a04c98597c2ab37c0d9d536707c2dcd2d1f7bdc0a26fc9b24a8a3035eaf88
MD5 hash:
1050aa5a1eaaa9f59f66b2e0f7702dd3
SHA1 hash:
62a245778e6459fd4b63197d8ad8e939502de479
Link:
https://www.unpac.me/results/9c5431ba-0b26-456a-8429-4724a13530dd/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/528a04c98597/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/528a04c98597c2ab37c0d9d536707c2dcd2d1f7bdc0a26fc9b24a8a3035eaf88

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Mars_Stealer
Create hunting rule
Author:@malgamy12
Description:detect_Mars_Stealer
Rule name:infostealer_win_stealc_standalone
Create hunting rule
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:sus_pe_free_without_allocation
Create hunting rule
Author:Maxime THIEBAUT (@0xThiebaut)
Description:Detects an executable importing functions to free memory without importing allocation functions, often indicative of dynamic import resolution
Rule name:win_stealc_w0
Create hunting rule
Author:crep1x
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/435899/
  
URLhaus
https://urlhaus.abuse.ch/url/2691580/

Comments