MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 15

Intelligence 15 IOCs YARA 3 File information Comments

SHA256 hash:	5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42
SHA3-384 hash:	adf95290bcfbc5f39c8a1634f82f75e3d06fdbd8bdd2c7afd3a93413f545c70c8f78e01d9f768b535ca65d820bcef493
SHA1 hash:	9c061dd13a4733a178edfc92481e67b91a0c6558
MD5 hash:	4555fd6d06e3969a3885f736992f3251
humanhash:	xray-dakota-don-river
File name:	file
Download:	download sample
Signature	Stealc Create hunting rule
File size:	3'647'040 bytes
First seen:	2025-11-03 06:58:27 UTC
Last seen:	2025-11-03 08:18:10 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a56f115ee5ef2625bd949acaeec66b76 (53 x Stealc, 46 x PureHVNC, 28 x RedLineStealer)
ssdeep	98304:lLX4WdpiECbsl1JPmIXD6R0bTDZniild/Z:F9JPhm4iild/Z
Threatray	123 similar samples on MalwareBazaar
TLSH	T1D8F52254394384B2E82CCF7F61130CDAD3521D187B2986BC2D99FEB38376DB94A5929C
TrID	38.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.6% (.ICL) Windows Icons Library (generic) (2059/9) 15.4% (.EXE) OS/2 Executable (generic) (2029/13) 15.2% (.EXE) Generic Win/DOS Executable (2002/3) 15.2% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543 Stealc

Bitsight

url: http://178.16.55.189/files/5917492177/7rbUMPu.exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2025-11-03 06:59:09 UTC

Tags:

stealc stealer themida

Link:

https://app.any.run/tasks/116a9b9b-7872-40d3-8e7d-c47128d0548f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Stealc

Link:

https://www.capesandbox.com/analysis/35051/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.55238486.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6908529f9942f1282ecb9a09

Tags:

injection cobalt packed obfusc

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Sending an HTTP POST request to an infection source

Connection attempt to an infection source

Gathering data

Verdict:

Malicious

Labled as:

Mikey.Generic

Link:

https://www.hybrid-analysis.com/sample/5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42

Verdict:

Malicious

File Type:

exe x64

First seen:

2025-11-03T04:27:00Z UTC

Last seen:

2025-11-03T16:28:00Z UTC

Hits:

~100

Detections:

VHO:Trojan-PSW.Win32.Lumma.gen VHO:Trojan-PSW.Win32.Lumma.xin Trojan-PSW.Lumma.HTTP.C&C PDM:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/78ec042c-f10b-4893-9bfe-48aa1292a6a0

Score:

41%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/4555fd6d06e3969a3885f736992f3251

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42/

Verdict:

Malicious

Threat:

Family.STEALC

Link:

https://tip.neiki.dev/file/5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42

Threat name:

Win64.Trojan.Egairtigado

Status:

Malicious

First seen:

2025-11-03 06:59:33 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

28 of 38 (73.68%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lr63vxqneupysrcjjpb3p5nmiq7be73ebkf6q2td22uopsnfnvba._file

Verdict:

malicious

Label(s):

shellcode_loader_007

Stealc

40062fc584624b5295f5ee7e1b942c561186a07f5adbaa64d3b53e09fae0be88

Stealc

47208cb5086c7aa9934c48c4c704d8f2d76471e41f3fa39fbaaeb02440445a09

Stealc

5a4a506bd9bef25b31aebdc7ee588a7af4c2ea507bb6cd3de1453c60fc6d053a

Stealc

69c8d607554e50efea2112b0f06cbb3e1c168e911a986c7f1d84fee3aa39f02c

Stealc

error

Stealc

+ 113 additional samples on MalwareBazaar

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc botnet:tr1pernn defense_evasion stealer themida trojan

Link:

https://tria.ge/reports/251103-hsa9ase16d/

Behaviour

Checks whether UAC is enabled

Checks BIOS information in registry

Themida packer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Stealc

Stealc family

Malware Config

C2 Extraction:

http://178.16.54.175

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/7d3d4720-3f8d-4bbd-b2ed-80fa4b734555

Unpacked files

SH256 hash:

5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42

MD5 hash:

4555fd6d06e3969a3885f736992f3251

SHA1 hash:

9c061dd13a4733a178edfc92481e67b91a0c6558

Link:

https://www.unpac.me/results/d0b47821-606e-443e-ba92-e7081e26a3ee/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5c7dbade0d25/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 5c7dbade0d251f8944494bc3b7f5ac443e127f640a8be86a63d6a8e7c9a56d42

(this sample)

Dropped by

Amadey

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3694668/

Cape

https://www.capesandbox.com/analysis/35051/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample