MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 19


Intelligence 19 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e
SHA3-384 hash: 16d18c4450c4d57a44e8037b97d84c91f7466f81777ea6b338f8d6f69ed2814fefa1d6d04a59d21eab27bdaa2d487da0
SHA1 hash: b7c3534d9b056c6ee54e1fa5a0ee75fd53e10b72
MD5 hash: 7a41f381dbc09e0ef8941739b28344e1
humanhash: nuts-jupiter-sink-yellow
File name:585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:1'906'176 bytes
First seen:2024-09-09 15:37:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 24576:jw3P1kZ6wNEOrA8NHtjAvoPqyxxSHMfOrU6Ak+gX5HmeFmL3qKKGL7ABx0M+2naP:c3tkZ/LNHtbkUqRJ63hKQ2naoEX
TLSH T172953332C2536227C381C2799CD7E16D39D6758208DE9AF7730A67C1794EB0966E8F83
TrID 29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Chainskilabs
Tags:exe Stealc

Intelligence

File Origin
# of uploads :
1
# of downloads :
413
Origin country :
US US
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e
Verdict:
Malicious activity
Analysis date:
2024-09-09 13:52:21 UTC
Tags:
amadey botnet stealer themida
Link:
https://app.any.run/tasks/1c5b61a4-8803-4026-893d-28ff8a14773e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.MulDrop28.17906.21383.11582.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66df165d76bc4542b0494759
Tags:
Execution Generic Network Other Stealth Trojan Crypt
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for analyzing tools
Creating a file
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Connection attempt to an infection source
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm anti-vm microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/66df165b7fd554a24b9b64fa/reports/901a3b35-3c19-4840-a3ee-48ab3fcd197c/overview
Verdict:
Malicious
Labled as:
Kryptik.Generic
Link:
https://www.hybrid-analysis.com/sample/585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e65db006-6be2-4a02-a498-fdef89705018
Result
Threat name:
Amadey, Clipboard Hijacker, CryptOne, Cr
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1508115
Signature
.NET source code contains very large array initializations
AI detected suspicious sample
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops large PE files
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Installs new ROOT certificates
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May use the Tor software to hide its network traffic
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Potentially malicious time measurement code found
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses process hollowing technique
Suricata IDS alerts for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Amadeys stealer DLL
Yara detected Clipboard Hijacker
Yara detected Cryptbot
Yara detected CryptOne packer
Yara detected DanaBot stealer dll
Yara detected Generic Downloader
Yara detected Powershell download and execute
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected Stealc
Yara detected Vidar stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1508115 Sample: XpCyBwDzEt.exe Startdate: 09/09/2024 Architecture: WINDOWS Score: 100 93 fivev5sb.top 2->93 95 femininedspzmhu.shop 2->95 97 12 other IPs or domains 2->97 119 Suricata IDS alerts for network traffic 2->119 121 Found malware configuration 2->121 123 Malicious sample detected (through community Yara rule) 2->123 125 24 other signatures 2->125 10 axplong.exe 43 2->10         started        15 XpCyBwDzEt.exe 5 2->15         started        17 axplong.exe 2->17         started        19 Hkbsse.exe 2->19         started        signatures3 process4 dnsIp5 109 185.215.113.16, 49705, 49707, 49710 WHOLESALECONNECTIONSNL Portugal 10->109 111 185.215.113.26, 49711, 49717, 49720 WHOLESALECONNECTIONSNL Portugal 10->111 113 185.215.113.117, 49706, 80 WHOLESALECONNECTIONSNL Portugal 10->113 81 C:\Users\user\AppData\Local\Temp\...\RMS1.exe, PE32+ 10->81 dropped 83 C:\Users\user\AppData\Local\...\acentric.exe, PE32 10->83 dropped 85 C:\Users\user\AppData\Local\...\bundle.exe, PE32 10->85 dropped 91 17 other malicious files 10->91 dropped 181 Hides threads from debuggers 10->181 183 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->183 185 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 10->185 21 crypteda.exe 10->21         started        24 stealc_default2.exe 10->24         started        28 gold.exe 2 10->28         started        32 6 other processes 10->32 87 C:\Users\user\AppData\Local\...\axplong.exe, PE32 15->87 dropped 89 C:\Users\user\...\axplong.exe:Zone.Identifier, ASCII 15->89 dropped 187 Detected unpacking (changes PE section rights) 15->187 189 Tries to evade debugger and weak emulator (self modifying code) 15->189 191 Tries to detect virtualization through RDTSC time measurements 15->191 193 Potentially malicious time measurement code found 15->193 30 axplong.exe 15->30         started        file6 signatures7 process8 dnsIp9 145 Antivirus detection for dropped file 21->145 147 Multi AV Scanner detection for dropped file 21->147 149 Machine Learning detection for dropped file 21->149 151 Injects a PE file into a foreign processes 21->151 34 RegAsm.exe 21->34         started        38 RegAsm.exe 21->38         started        40 RegAsm.exe 21->40         started        51 2 other processes 21->51 101 185.215.113.17, 49718, 80 WHOLESALECONNECTIONSNL Portugal 24->101 65 C:\Users\user\AppData\...\softokn3[1].dll, PE32 24->65 dropped 67 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 24->67 dropped 69 C:\Users\user\AppData\...\mozglue[1].dll, PE32 24->69 dropped 77 9 other files (5 malicious) 24->77 dropped 153 Tries to steal Mail credentials (via file / registry access) 24->153 155 Found many strings related to Crypto-Wallets (likely being stolen) 24->155 163 4 other signatures 24->163 165 3 other signatures 28->165 42 RegAsm.exe 6 24 28->42         started        45 conhost.exe 28->45         started        157 Detected unpacking (changes PE section rights) 30->157 159 Tries to detect sandboxes and other dynamic analysis tools (window names) 30->159 167 4 other signatures 30->167 103 185.215.113.67 WHOLESALECONNECTIONSNL Portugal 32->103 105 fivev5sb.top 80.249.144.180 SELECTELRU Russian Federation 32->105 107 4 other IPs or domains 32->107 71 C:\Users\user\Pictures\...\acentric.exe, PE32 32->71 dropped 73 C:\Users\user\AppData\...\svchost015.exe, PE32 32->73 dropped 75 C:\Users\user\AppData\...\service123.exe, PE32 32->75 dropped 79 4 other malicious files 32->79 dropped 161 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 32->161 169 4 other signatures 32->169 47 svchost015.exe 32->47         started        49 Hkbsse.exe 32->49         started        file10 signatures11 process12 dnsIp13 61 C:\Users\user\AppData\...\g1BNC6IJx4.exe, PE32 34->61 dropped 63 C:\Users\user\AppData\...behaviorgraphLVTQAjNpJ.exe, PE32 34->63 dropped 127 Found many strings related to Crypto-Wallets (likely being stolen) 34->127 53 g1BNC6IJx4.exe 34->53         started        57 GLVTQAjNpJ.exe 34->57         started        115 95.179.250.45, 26212, 49708 AS-CHOOPAUS Netherlands 42->115 129 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 42->129 131 Installs new ROOT certificates 42->131 133 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 42->133 135 Tries to steal Crypto Currency Wallets 42->135 117 91.202.233.158 M247GB Russian Federation 47->117 137 Detected unpacking (changes PE section rights) 47->137 139 Detected unpacking (overwrites its own PE header) 47->139 141 Multi AV Scanner detection for dropped file 49->141 143 Machine Learning detection for dropped file 49->143 file14 signatures15 process16 dnsIp17 99 65.21.18.51, 45580, 49714 CP-ASDE United States 53->99 171 Multi AV Scanner detection for dropped file 53->171 173 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 53->173 175 Found many strings related to Crypto-Wallets (likely being stolen) 53->175 179 2 other signatures 53->179 177 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 57->177 59 conhost.exe 57->59         started        signatures18 process19
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-09-09 12:01:39 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
22 of 24 (91.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lbjrrfl3agspq2jzsr64zjn5appcpayywfxiz5rqx62g5g3qjuha._file
Verdict:
malicious
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:cryptbot family:lumma family:redline family:stealc botnet:@cloudytteam botnet:bundle botnet:default botnet:default2 botnet:fed3aa botnet:livetraffic credential_access defense_evasion discovery evasion infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/240909-s22sqawark/
Behaviour
Checks processor information in registry
Modifies system certificate store
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Windows directory
Enumerates processes with tasklist
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Indicator Removal: File Deletion
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Identifies Wine through registry keys
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Downloads MZ/PE file
Credentials from Password Stores: Credentials from Web Browsers
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
CryptBot
Lumma Stealer, LummaC
RedLine
RedLine payload
Stealc
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
http://185.215.113.16
95.179.250.45:26212
65.21.18.51:45580
http://185.215.113.17
http://91.202.233.158
185.215.113.67:15206
https://femininedspzmhu.shop/api
https://tenntysjuxmz.shop/api
fivev5sb.top
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/862658ae-84f5-4c46-8a01-5d8b382b043d
Unpacked files
SH256 hash:
bc22f11a2985f7f1cb8609f35e2625a7e39df66de8cff62c4b1226cebca22e0a
MD5 hash:
083e3e4a125e72c0e7277eaf3cc2ecd5
SHA1 hash:
19ad3b25421c068ff0b29197aac4efe4a7640267
Detections:
win_amadey
Create hunting rule
Link:
https://www.unpac.me/results/344cf5c9-518e-4926-bb57-ce0ae39bc021/
SH256 hash:
585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e
MD5 hash:
7a41f381dbc09e0ef8941739b28344e1
SHA1 hash:
b7c3534d9b056c6ee54e1fa5a0ee75fd53e10b72
Link:
https://www.unpac.me/results/344cf5c9-518e-4926-bb57-ce0ae39bc021/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/585318957b01/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 585318957b01a4f86939947dcca5bd03de278318b16e8cf630bfb46e9b704d0e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3138946/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3067427/
  
URLhaus
https://urlhaus.abuse.ch/url/3067442/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments