MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e22c0f2732195063cb4984c6520c3b85e1236e967f8bb05b3c1b35139d2917b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 13

Intelligence 13 IOCs YARA 17 File information Comments

SHA256 hash:	6e22c0f2732195063cb4984c6520c3b85e1236e967f8bb05b3c1b35139d2917b
SHA3-384 hash:	95669fdb448c2f496481caecb91f22121df3aa345c58375a32caa3a8d271d8e0f5cba0fcb98a723d1840a0e57cdeb4b2
SHA1 hash:	28181880164f5f73c611126dee950af8036e9988
MD5 hash:	ae47c12b9320e702a9ce243193494554
humanhash:	salami-illinois-potato-monkey
File name:	file
Download:	download sample
Signature	Stealc Create hunting rule
File size:	8'741'088 bytes
First seen:	2024-05-27 18:39:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9dda1a1d1f8a1d13ae0297b47046b26e (64 x Formbook, 39 x GuLoader, 22 x RemcosRAT)
ssdeep	196608:Fv1W8cKlJIszteRKn1chTDQfW7ancKlJIszteRKn1chTDQfWg:Fv1W8v1Bee1chTseenv1Bee1chTseg
Threatray	36 similar samples on MalwareBazaar
TLSH	T1239633CB65C4D076D44D8D366AAEC673326D933A1A8321DEBB09F569C1B8DCFB85E001
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	69ccd4d49696cc71 (13 x Adware.Adload, 8 x CoinMiner, 7 x ValleyRAT)
Reporter	Bitsight
Tags:	exe Stealc

Bitsight

url: https://www.justmake.tw/temp/Setup.exe

Intelligence

File Origin

# of uploads :

# of downloads :

550

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

6e22c0f2732195063cb4984c6520c3b85e1236e967f8bb05b3c1b35139d2917b.exe

Verdict:

Malicious activity

Analysis date:

2024-05-27 18:39:32 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/abe921bf-3b76-444a-a7be-30de63ac1811

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.FileRepMalware.30353.31017.UNOFFICIAL

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6654d390121317197511ff23win7simulatehigh_evasion

Tags:

Banker Encryption Static Stealth Dexter

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Behavior that indicates a threat

DNS request

Connection attempt

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Running batch commands

Creating a process with a hidden window

Launching a process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/6654d3869c0b71aaf52999db/reports/0402a0cb-a696-43ae-a078-2b474eb8e554/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6e22c0f2732195063cb4984c6520c3b85e1236e967f8bb05b3c1b35139d2917b

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a3cb5b03-2504-4220-bc89-929fdff17093

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1448103

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Malicious sample detected (through community Yara rule)

Opens network shares

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

28%

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/6e22c0f2732195063cb4984c6520c3b85e1236e967f8bb05b3c1b35139d2917b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6e22c0f2732195063cb4984c6520c3b85e1236e967f8bb05b3c1b35139d2917b/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nyrmb4ttegkqmpfutbggkigdxbpbenxjm74lwbntygzvcoossf5q._file

Verdict:

malicious

Stealc

3ede1d83cc31cb357a158ed3e98e0f6722e0f3fe1ec023e539df3ea83b9067b3

Stealc

6696728008399e456f469a267ee65dc5e5ba68a2b84a1772a458f2ee7e8bdec2

Stealc

6efd90bc5941feb14ded5c431bf7c1cf179f28c449a848cb7c1434cc4fae1ede

Stealc

7257c1c18b84857d106c9eba7a93222e85798e270eb99c21953ece1e8a879bef

Stealc

744eddd9b4b8158a0ae22a864deb7c5a9741d192b2dc08eeaa54133fe5c328c4

Stealc

8341fb2716f2fc1fd17f640022928c378f66732f2f1afbc9a1ca8aa2af1a28fb

Stealc

df627184bb78e33980b55662e826fb3b6f4550efa2dc0eb20260f348cb150251

Stealc

+ 26 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:stealc family:vidar discovery spyware stealer

Link:

https://tria.ge/reports/240527-xa7l4sdf3s/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Detect Vidar Stealer

Stealc

Vidar

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/5c63617e-6542-46c0-a7eb-dcc8c4262fe6

Unpacked files

SH256 hash:

d4d4d4bf651c299940bd2c4ed1df985f3aabd2432a932e3339add02f00e76cc8

MD5 hash:

eced1eb8b854d6999b543cccf86aeb68

SHA1 hash:

58ec903d0834b36ecc06a275c77eb12efd71f5f2

Detections:

VidarStealer

win_stealc_a0

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Link:

https://www.unpac.me/results/e53951c3-89f6-4052-9652-54c515a531dd/

SH256 hash:

e74f442771f034a24b77d3a849b343551bdef69ef151c622cb9fd5f34dccda81

MD5 hash:

dc91f181f9cb870fff0c58bc0ea63eda

SHA1 hash:

cc37e24f6071dea801d0eb59bcc2a9221cf1c74b

Link:

https://www.unpac.me/results/e53951c3-89f6-4052-9652-54c515a531dd/

SH256 hash:

89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

MD5 hash:

b7d61f3f56abf7b7ff0d4e7da3ad783d

SHA1 hash:

15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

Link:

https://www.unpac.me/results/e53951c3-89f6-4052-9652-54c515a531dd/

SH256 hash:

2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

MD5 hash:

adb29e6b186daa765dc750128649b63d

SHA1 hash:

160cbdc4cb0ac2c142d361df138c537aa7e708c9

Detections:

INDICATOR_TOOL_UAC_NSISUAC

Link:

https://www.unpac.me/results/e53951c3-89f6-4052-9652-54c515a531dd/

Parent samples :

f5f3e5658f8ec6c1e7ffa7e7d6df06d04af1f3a5941206ce23b8be979c60ccb1
6e22c0f2732195063cb4984c6520c3b85e1236e967f8bb05b3c1b35139d2917b
713a497c8da97c2082758fd31147539f408a72b62041c6c9ed77037021621e94
dbde8a4bd71bb1fbc0511cdb657dfeffdaedc513aa425f856043532a7cba6fce
ac142a8087949b5ad4e3a503ca37609845112c4f7e0cd1376669c9d5c8f5cdf2
15d4dbafb6fb1770507db7769b2df6f3857da0ad3203a71c5f82a99688dac2b3
b96862087581adb9ecfb9615a46eedb29d13c606e708b7b532ce6ed3217925a4
4f2e6dc8e4d8e0dfcc44a28d34c10653bd833abb8832e47e609d255f246c67f0
df61dc2d24f2e475e0a8971c5d21c1c48e9505be67714aafb4afd670aad297e3
60b1aa37a4ac40d5c5adf2de28782976934731408b6c2e89511e1bc5947d5bbd
f7ae58f22cbdeb69318f6cb3ff3757a9888e8731febd66e85ee9938f874705c9
fbfe2108631e3ccaa8db2f5c4439009c7a5a53136481b422236eefe2e48b690f
340b93c76e6f489982a23d2e04df0ad05a03c3d744ecb5badc3c041eca945af2
34a5c9c0106b37687fbdd51a60a026d06e7301ec40b1f7fb49384d8fe748e9e6
503c9fae00b047a77059de8e9ff6dddb6d2584f18ccf6480d69d395c65492ad4

SH256 hash:

23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

MD5 hash:

192639861e3dc2dc5c08bb8f8c7260d5

SHA1 hash:

58d30e460609e22fa0098bc27d928b689ef9af78

Link:

https://www.unpac.me/results/e53951c3-89f6-4052-9652-54c515a531dd/

SH256 hash:

0542791d5427879928672e7f962b6130495c5592252ba8470b7fedb03aa6f2d0

MD5 hash:

ba739966d163e955110750d63546d183

SHA1 hash:

a6506a13e1d16c818742538746bb2ff9f99d430d

Link:

https://www.unpac.me/results/e53951c3-89f6-4052-9652-54c515a531dd/

SH256 hash:

6e22c0f2732195063cb4984c6520c3b85e1236e967f8bb05b3c1b35139d2917b

MD5 hash:

ae47c12b9320e702a9ce243193494554

SHA1 hash:

28181880164f5f73c611126dee950af8036e9988

Link:

https://www.unpac.me/results/e53951c3-89f6-4052-9652-54c515a531dd/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6e22c0f2732195063cb4984c6520c3b85e1236e967f8bb05b3c1b35139d2917b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Dlls Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	EXE_Vidar_May_2024 Create hunting rule
Author:	NDA0E
Description:	Detects Vidar payload

Rule name:	has_telegram_urls Create hunting rule
Author:	Aaron DeVera<aaron@backchannel.re>
Description:	Detects Telegram URLs

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	NSIS_April_2024 Create hunting rule
Author:	NDA0N
Description:	Detects NSIS installers

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Windows_Generic_Threat_c374cd85 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Donutloader_f40e3759 Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 6e22c0f2732195063cb4984c6520c3b85e1236e967f8bb05b3c1b35139d2917b

(this sample)

Dropped by

Privateloader

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2865864/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AdjustTokenPrivileges
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteExW SHELL32.dll::SHFileOperationW SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW ADVAPI32.dll::OpenProcessToken KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetDiskFreeSpaceW KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::MoveFileExW
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuW USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::OpenClipboard USER32.dll::PeekMessageW USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample