MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b35b46a864d2ee03b85ba71e118fd1f3bf9e820fcc5d6aa5a7b745d75472009. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 15

Intelligence 15 IOCs YARA 12 File information Comments 1

SHA256 hash:	6b35b46a864d2ee03b85ba71e118fd1f3bf9e820fcc5d6aa5a7b745d75472009
SHA3-384 hash:	afc9b61b96eaec9b3f94eda1a1d92118d6a7419c7264dc73dd3f0af9f19737a4bf44ca11c62456566daaa4481d66242a
SHA1 hash:	1100f916f8b5dffe4987167a493c2d0a4d92a05f
MD5 hash:	dff504b0b52beb1847292c7ca09c38ba
humanhash:	maryland-jupiter-freddie-beer
File name:	dff504b0b52beb1847292c7ca09c38ba
Download:	download sample
Signature	Stealc Create hunting rule
File size:	343'040 bytes
First seen:	2023-11-25 04:27:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ac2a65b4a5041877693100400bbe0f6f (8 x Smoke Loader, 5 x Stealc, 1 x Vidar)
ssdeep	6144:OZ49eKSgaIt1u2yIMk2sSVsWJ8xkWTGx:OZ49/IulMk2rVdJ+T6
Threatray	703 similar samples on MalwareBazaar
TLSH	T1A274835386E33D44EA268B72DF2E86EC7B1DF7508E4B7B6612189E2F44B0276D163710
TrID	34.8% (.EXE) Win64 Executable (generic) (10523/12/4) 16.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 14.9% (.EXE) Win32 Executable (generic) (4505/5/1) 6.8% (.ICL) Windows Icons Library (generic) (2059/9) 6.7% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	0000100808080000 (1 x Stealc)
Reporter	zbetcheckin
Tags:	32 exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

409

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

http://5.42.65.80/decord.exe

Verdict:

Malicious activity

Analysis date:

2023-11-25 01:52:05 UTC

Tags:

evasion loader stealer stealc

Link:

https://app.any.run/tasks/a6d70c81-10f2-413e-94b3-05689913fb2e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/460119/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Clean

Maliciousness:

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/656177d2bcca970107cb7f34/reports/73cded3e-9566-45d8-a1fb-ca077b679de2/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/6b35b46a864d2ee03b85ba71e118fd1f3bf9e820fcc5d6aa5a7b745d75472009

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d7aba3ba-cad3-4285-83ed-1b92cafdcbc3

Result

Threat name:

Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1347669

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6b35b46a864d2ee03b85ba71e118fd1f3bf9e820fcc5d6aa5a7b745d75472009

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6b35b46a864d2ee03b85ba71e118fd1f3bf9e820fcc5d6aa5a7b745d75472009/

Threat name:

Win32.Spyware.Stealc

Status:

Malicious

First seen:

2023-11-25 05:02:39 UTC

AV detection:

27 of 37 (72.97%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nm23i2ugjuxoao4fxjy6cgh5d457t2ba7tc5nks2pn2f25kheaeq._file

Verdict:

malicious

Stealc

2bd90ebb9e56d79b4f68f92a47c8d78c97a0d4290966325c0c49744bc21b491f

Stealc

5a08016b7110cf63c4e5fca8976b9afc9d6da94650ffb9e14129b30364e939a2

Stealc

6b35b46a864d2ee03b85ba71e118fd1f3bf9e820fcc5d6aa5a7b745d75472009

Stealc

a726ad80960cf547e9154a39a704a48b98079786d896c5544044a7c3044d5a18

Stealc

d381efbc2ea684b34bd852804284d9a9a27ce458be61ee375268d76681bec748

Stealc

+ 693 additional samples on MalwareBazaar

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc discovery spyware stealer

Link:

https://tria.ge/reports/231125-e3netsgf29/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Stealc

Malware Config

C2 Extraction:

http://raphaelbischoff.icu

Unpacked files

SH256 hash:

baf12d4e40a07111d2c889e167479553e63c1a7dbc1d509718d596fee5dfe7ed

MD5 hash:

b49c3ca54c4b33bf414e8f74064e82dc

SHA1 hash:

fa2a9013d7b760c7cce5305c2beaf3205116d292

Detections:

stealc

win_stealc_a0

win_stealc_bytecodes_oct_2023

Link:

https://www.unpac.me/results/ad026654-377e-409d-8ab9-21c6c0ff640a/

Parent samples :

6b35b46a864d2ee03b85ba71e118fd1f3bf9e820fcc5d6aa5a7b745d75472009
1004e1aa6d023b53325d5d8f9aeec8d7e13476b8e3810ea1584641a134da5619
fc640eccc218468f096e9d977b7d2c94bf56877089b64d4f3f56ed894dda0cdf
49b9bed8c75d31a496808f435537937b8d7a08e86456ceae55a59c88a660a3bf
7729e5b688bdac64950e3245bcc28e027c34a4528070cc014b8e3fc061ae56b9
484da5003c2635306e7fed565b9b0f53186ccaf21888b4050ab5ee3116c09c4e
d0b64df818cec79d629e729f725cbf4ed071da6fe4b3b040240b2e044868896c
ac52a59fc88a6ec3cb00e0ef0e20cfe8df14a85b46b306e246fcc7a8c4212227
a4c64edea682e7e5c213f735a270db10a71a8f4c9a0bfe6b2a93f778e327bf88
8f2cbb17f7a036d63725c23212b14b4cb4ba51bbd5ff171ee36975c85381c33f

SH256 hash:

6b35b46a864d2ee03b85ba71e118fd1f3bf9e820fcc5d6aa5a7b745d75472009

MD5 hash:

dff504b0b52beb1847292c7ca09c38ba

SHA1 hash:

1100f916f8b5dffe4987167a493c2d0a4d92a05f

Link:

https://www.unpac.me/results/ad026654-377e-409d-8ab9-21c6c0ff640a/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6b35b46a864d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6b35b46a864d2ee03b85ba71e118fd1f3bf9e820fcc5d6aa5a7b745d75472009

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Mars_Stealer Create hunting rule
Author:	@malgamy12
Description:	detect_Mars_Stealer

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of MFA browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	Trojan_W32_Gh0stMiancha_1_0_0 Create hunting rule

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	yarahub_win_stealc_bytecodes_oct_2023 Create hunting rule
Author:	Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 6b35b46a864d2ee03b85ba71e118fd1f3bf9e820fcc5d6aa5a7b745d75472009

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/460119/

URLhaus

https://urlhaus.abuse.ch/url/2735157/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-11-25 04:27:44 UTC

url : hxxp://tomwallner.icu/syncUpd.exe