🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203
SHA3-384 hash: ef2e3be39dbc86ac672714358ebb019210c6144abd0b07ca42c44fc417344bee5c5997bdb617e4b8b43a15f71bf02680
SHA1 hash: 99fe57f3c8ed2efab58b3e42993dd513e79bad16
MD5 hash: 7fdd5cd187158d5e471eeaee8918cb47
humanhash: hotel-beer-alabama-massachusetts
File name:WindowsCodecs.dll
Download: download sample
Signature Stealc
Create hunting rule
File size:10'691'584 bytes
First seen:2025-12-23 15:04:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 62 x CobaltStrike, 44 x JanelaRAT)
ssdeep 196608:TMBqZR7laXRRQeNw7dADHGwI8veYeekr5OGN:9b7cBnNadAxI3ICOGN
TLSH T119B66B14A4D82607FD7EDFBC999E76540F7AB2952501BB288F5209D92BD2B58CC038F3
TrID 56.5% (.EXE) Win64 Executable (generic) (10522/11/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter aachum
Tags:146-103-104-211 dll Stealc


Avatar
iamaachum
https://182164372183.com/idown.php

Stealc C2: http://146.103.104.211/f999fb4b778f4b7a.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://146.103.104.211/f999fb4b778f4b7a.php https://threatfox.abuse.ch/ioc/1685149/

Intelligence

File Origin
# of uploads :
1
# of downloads :
114
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203.dll
Verdict:
No threats detected
Analysis date:
2025-12-23 15:05:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/88d9d6c3-8fc9-4530-bcc9-7e17f2f28c17

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45862/
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=690a12f59942f1282ecbf5ee
Tags:
dropper virus blic
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203
Verdict:
Malicious
File Type:
executable.pe.64.dll
First seen:
2025-12-23T12:07:00Z UTC
Last seen:
2025-12-23T12:24:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.MSIL.Agent.gen Trojan-PSW.Win64.StealC.sb
Link:
https://opentip.kaspersky.com/59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/042150e4-51ba-46d6-8ea0-f48e6bee5735
Result
Threat name:
Stealc v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1838278
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Early bird code injection technique detected
Found malware configuration
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses string decryption to hide its real strings
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected Stealc v2
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1838278 Sample: WindowsCodecs.dll.exe Startdate: 23/12/2025 Architecture: WINDOWS Score: 100 56 Suricata IDS alerts for network traffic 2->56 58 Found malware configuration 2->58 60 Antivirus detection for URL or domain 2->60 62 9 other signatures 2->62 8 loaddll64.exe 1 2->8         started        10 elevation_service.exe 2->10         started        12 elevation_service.exe 2->12         started        14 elevation_service.exe 2->14         started        process3 process4 16 rundll32.exe 3 8->16         started        19 rundll32.exe 2 8->19         started        21 cmd.exe 1 8->21         started        23 2 other processes 8->23 signatures5 46 Hijacks the control flow in another process 16->46 48 Writes to foreign memory regions 16->48 50 Allocates memory in foreign processes 16->50 25 RegAsm.exe 48 16->25         started        52 Modifies the context of a thread in another process (thread injection) 19->52 54 Injects a PE file into a foreign processes 19->54 30 RegAsm.exe 19->30         started        32 rundll32.exe 21->32         started        process6 dnsIp7 44 146.103.104.211, 49686, 80 BELNETBE Belgium 25->44 42 C:\ProgramData\wBoxBEEqxlvk, PE32+ 25->42 dropped 64 Early bird code injection technique detected 25->64 66 Tries to harvest and steal browser information (history, passwords, etc) 25->66 68 Writes to foreign memory regions 25->68 70 5 other signatures 25->70 34 msedge.exe 25->34         started        36 msedge.exe 25->36         started        38 msedge.exe 25->38         started        40 3 other processes 25->40 file8 signatures9 process10
Score:
73%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.52 Win 64 Exe x64
Link:
https://app.malva.re/file/7fdd5cd187158d5e471eeaee8918cb47
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203/
Verdict:
Malicious
Threat:
Trojan-PSW.Win64.StealC
Link:
https://tip.neiki.dev/file/59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-23 15:05:08 UTC
File Type:
PE+ (.Net Dll)
Extracted files:
3
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lg6ngl6saa62skiddfrjjvqear6s7zzyjimuvfnu2ttpyh7caibq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251223-trm29awmfz/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/76500027-3354-413a-9caf-08de144548f6
Unpacked files
SH256 hash:
59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203
MD5 hash:
7fdd5cd187158d5e471eeaee8918cb47
SHA1 hash:
99fe57f3c8ed2efab58b3e42993dd513e79bad16
Link:
https://www.unpac.me/results/b545a47e-71f6-4524-b8ac-4330a064609b/
Malware family:
Stealc.v2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/59bcd32fd200/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.56
Link:
https://yomi.yoroi.company/submissions/59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

zip 31b9e19854e307d2aad542cdf7094319b0dfc67b3f1da9ae3205fb43a6422136

Stealc

Executable exe 59bcd32fd2003da92903196294d604047d2fe7384a194a95b4d4e6fc1fe20203

(this sample)

  
Link
https://tria.ge/251223-r4j51stlb1/behavioral2
  
Dropped by
SHA256 31b9e19854e307d2aad542cdf7094319b0dfc67b3f1da9ae3205fb43a6422136
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/45862/
  
Dropped by
MD5 d6dac6e34fd6e2a1669885a58675dfad

Comments