MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52957d4501c8b066b7208e418ddb49848c116905b2a8c3d37366ed188fb99eda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 17


Intelligence 17 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52957d4501c8b066b7208e418ddb49848c116905b2a8c3d37366ed188fb99eda
SHA3-384 hash: 00654b522deb3773b76fc2a01f8fe62f5bc29ba3a4439dc37a18348b8a8fa24dc5b5ba6948bbd4f1ed2c363ea7ac6a21
SHA1 hash: d3464cf08ff3e16c81d08cefd1c6159c0a501a31
MD5 hash: 85424194e3012b5970ef13dda8861ae7
humanhash: timing-seventeen-xray-montana
File name:file
Download: download sample
Signature Stealc
Create hunting rule
File size:1'845'248 bytes
First seen:2024-10-25 16:53:08 UTC
Last seen:2024-10-25 17:42:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:8gaeIscyHv+wLZNB/vpjqB/s1qoI5mfIG+9xRe:8gVIZyFZLvMGEx5m1k3e
Threatray 151 similar samples on MalwareBazaar
TLSH T18D853343EA77D426D00882BA4FB8873EF7228D1F257117298DB4F9626D8768F7D149B0
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Bitsight
Tags:exe Stealc


Avatar
Bitsight
url: http://185.215.113.16/steam/random.exe

Intelligence

File Origin
# of uploads :
22
# of downloads :
445
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-10-25 17:22:50 UTC
Tags:
stealc stealer themida
Link:
https://app.any.run/tasks/e18cdabe-488b-41e2-9d9b-b606833455f5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.16210.3903.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=671bcd2fa75e41aa6721676e
Tags:
Lien Spam
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Connection attempt to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/671bcd351b7d1aa8b0e9aa0a/reports/6861a358-d7de-44f0-b7a4-e0154e77010d/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/52957d4501c8b066b7208e418ddb49848c116905b2a8c3d37366ed188fb99eda
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/5bf24be4-a091-4a23-8f61-686056e71511
Result
Threat name:
Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1542292
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
PE file contains section with special chars
Searches for specific processes (likely to inject)
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/52957d4501c8b066b7208e418ddb49848c116905b2a8c3d37366ed188fb99eda
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52957d4501c8b066b7208e418ddb49848c116905b2a8c3d37366ed188fb99eda/
Threat name:
Win32.Infostealer.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2024-10-25 16:54:08 UTC
File Type:
PE (Exe)
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kkkx2ribzcygnnzarzay3w2jqsgbc2ifwkumhu3tm3wrrd5zt3na._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
Similar samples:
1c0f5a3a31946a8d628cd2bc20c3cc90401e9bb758799dd39bbd1bb2ee5e010d
Stealc
31e9211fae2d58715bb7303d99973871697be2cb2bbc548730215dd13d47e2ec
Stealc
6dbfc677cbb25ac652a97431f9afc4811639b3dae9b640976c0b9bb8d9a54404
Stealc
86db7dfb31cc072f944c5eb7c722e55ec5f832e39b22ff6c77d06f0fbf222720
Stealc
91ba938ce71b08ce44d7a11f8ece24bc8054a98becf5d6b17709d17b46b3554e
Stealc
b577aefb44dec944abb7b45b23f7daab2ff8ba47edbdb253316ddaf1f22e24b0
Stealc
d136fc0cb6c79f3a565dd49dc66123c8f3464183a474c2f4b4a13bbf342c1e97
Stealc
d46a2b0b7d5051eb2640ebe5832d00be2afdd49a8060c96ff3e2d0ffb99876d3
Stealc
ebb1b01d61c7e3ac4578f7b7193bc2f0a70909195f5f311e2e49f4a9974ca9a8
Stealc
error
Stealc
f57963771c5b3d4171996301a28452a49f89a76f8812aec518e6c93e0af7ca93
Stealc
+ 141 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:doma credential_access discovery evasion spyware stealer
Link:
https://tria.ge/reports/241025-vejdzazjhz/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks BIOS information in registry
Identifies Wine through registry keys
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Stealc
Stealc family
Malware Config
C2 Extraction:
http://185.215.113.37
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/01ad88c9-db32-4921-967b-9922b7c34307
Unpacked files
SH256 hash:
3bb9e683646607cb8d11b8e70f9f8f1ca6557a394ec10b13a1f20a5f4e4e489e
MD5 hash:
c35f1d21aa39dd2f687477e02ca0e719
SHA1 hash:
bb83e7bee388211db77037495482376796536f4a
Detections:
stealc
Create hunting rule
win_stealc_w0
Create hunting rule
win_stealc_a0
Create hunting rule
detect_Mars_Stealer
Create hunting rule
Link:
https://www.unpac.me/results/51346342-7016-47a4-8fea-1cf6e15d8c13/
SH256 hash:
52957d4501c8b066b7208e418ddb49848c116905b2a8c3d37366ed188fb99eda
MD5 hash:
85424194e3012b5970ef13dda8861ae7
SHA1 hash:
d3464cf08ff3e16c81d08cefd1c6159c0a501a31
Link:
https://www.unpac.me/results/51346342-7016-47a4-8fea-1cf6e15d8c13/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/52957d4501c8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/52957d4501c8b066b7208e418ddb49848c116905b2a8c3d37366ed188fb99eda

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MoleBoxv20
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 52957d4501c8b066b7208e418ddb49848c116905b2a8c3d37366ed188fb99eda

(this sample)

  
Dropped by
Amadey
  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3138947/
  
URLhaus
https://urlhaus.abuse.ch/url/3079150/
  
URLhaus
https://urlhaus.abuse.ch/url/3079215/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments