MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 16

Intelligence 16 IOCs YARA 10 File information Comments 1

SHA256 hash:	6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8
SHA3-384 hash:	90cb8970bdf39ef7a8b5ef598eccbde450e4aa54621a90e416369e8faab93191b4b8dbe3e328e4855316b1978b6a5c84
SHA1 hash:	7556260b8e59cea8f9048cf793f7c52ce75fff85
MD5 hash:	814d30fd5617213cc9765f05bf823181
humanhash:	red-arizona-floor-edward
File name:	814d30fd5617213cc9765f05bf823181
Download:	download sample
Signature	Stealc Create hunting rule
File size:	267'776 bytes
First seen:	2024-04-26 07:39:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	35d2f187a446fa7dcfd6bfdfd63133ca (1 x CMSBrute, 1 x Stealc)
ssdeep	3072:Ec9muhEkpG1d6T+DwVA0lG3NK9RrjxaEQrkXlp9O0oft4BnZzKsbQXmSIN8niPhr:eAgn6T7rEdrClphBnZG0xh8nSr
TLSH	T1CA44CF1132E1C4B1E16FC672C931BB6146FEFC729A60895733BC278E59702D0A7667A3
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	08181040a0200000 (1 x Stealc)
Reporter	zbetcheckin
Tags:	32 exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

404

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8.exe

Verdict:

Malicious activity

Analysis date:

2024-04-26 07:40:11 UTC

Tags:

stealer stealc

Link:

https://app.any.run/tasks/131eda87-98d7-4c4b-9aff-278e05e3715b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Connection attempt to an infection source

Sending an HTTP GET request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint stealc

Link:

https://www.filescan.io/uploads/662b5a5514ba3ce8289ad88e/reports/23172158-0bde-4dc6-b660-bc30c5375b95/overview

Verdict:

Malicious

Labled as:

Mikey.Generic

Link:

https://www.hybrid-analysis.com/sample/6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ce982957-e8a6-4a46-b10c-2137d8daa96e

Result

Threat name:

Mars Stealer, Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1432015

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Snort IDS alert for network traffic

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8/

Threat name:

Win32.Trojan.StealC

Status:

Malicious

First seen:

2024-04-26 06:22:56 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 23 (91.30%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nmtaykqdd7xcdilzmciqefavejnqa25krcf7ukrxyp3zzkdmvhea._file

Verdict:

malicious

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc stealer

Link:

https://tria.ge/reports/240426-jhjclabh5x/

Behaviour

Program crash

Stealc

Unpacked files

SH256 hash:

743875dcc496b10bc3b30df93f050fc7660b19a0125046769fcb5eb9166d62b9

MD5 hash:

3d508dd52445d80003ea8f82924983ed

SHA1 hash:

87573bf07f77149fd531082018f784992b183795

Detections:

stealc

win_stealc_auto

Link:

https://www.unpac.me/results/10075a9f-e1d2-4c47-8c0e-95cfbd042ce7/

Parent samples :

1a102b793f4cad2e1bffc0a7e25ffd3601744a616d19f7f5dbd57c8a116538b3
9bef7a636bd52f5ecd74c1f4041c73eefad5e23f8a978af0201f72cd24a9b0d0
fb63921ce0bda58d6277755b5e784e7b042f646d64ebbd230a6b9b8ab3db33d7
a4805aa4e8b2cb5956f757d210eaa3cd8d14b9f882f483473b1c5cc9c64c441d
1418981255cd087e37c0995615e09d0e969a1adafc29f7995156e0b1d4c40285
6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891
d5dbffe347a31cc50559e0c91f94f47fa1f134d3678c7721685af1bdf84be133
2daf90fbe9e99b9e0378f48a8b091fa703b735760ebf32ce609b40d4648a955e
8d8e0734ba1d608ef6ee124b1d5ab196223f6eb1d50348d1eb0b6ae57cd8ad3a
4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae
0a6e0a8505b349359dc63cc92fc46f879f19f43c246eb7e2445dcaca526d70fb
4d8b8c49b376c483e08d172646b49baf697d54b815b8357008117fed39c92cb0
c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0
cb664fc08a69a03e1d7ad2d47b9d7397330601fcfd8d559149ee606d782f14ad
dadc6e78d7628c9b004c60834d4f20729bf6718b972c31ef08c3bb7181a39a7f
6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8
a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3
1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f

SH256 hash:

6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8

MD5 hash:

814d30fd5617213cc9765f05bf823181

SHA1 hash:

7556260b8e59cea8f9048cf793f7c52ce75fff85

Link:

https://www.unpac.me/results/10075a9f-e1d2-4c47-8c0e-95cfbd042ce7/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6b260c2a031f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Mars_Stealer Create hunting rule
Author:	@malgamy12
Description:	detect_Mars_Stealer

Rule name:	infostealer_win_stealc_standalone Create hunting rule
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	malware_Stealc_str Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	Stealc infostealer

Rule name:	Windows_Trojan_Generic_2993e5a5 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Stealc_b8ab9ab5 Create hunting rule
Author:	Elastic Security

Rule name:	win_stealc_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.stealc.

Rule name:	win_stealc_w0 Create hunting rule
Author:	crep1x
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2810818/

URLhaus

https://urlhaus.abuse.ch/url/2754939/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetVolumeInformationW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleInputA KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleAliasesA KERNEL32.dll::GetConsoleProcessList KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateHardLinkA KERNEL32.dll::CreateFileW KERNEL32.dll::GetWindowsDirectoryA KERNEL32.dll::RemoveDirectoryA KERNEL32.dll::GetTempPathA
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-04-26 07:39:59 UTC

url : hxxp://185.172.128.127/timeSync.exe