MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 14

Intelligence 14 IOCs YARA 10 File information Comments

SHA256 hash:	6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891
SHA3-384 hash:	921ec5821a39e00f16dda0b593e4ce4a061002f41c4dac53120b78b2bcc86d607db5abf03a01a77062e6ffa35cd523ca
SHA1 hash:	a60a633f92a6631ffd21d7f11457319d5897c5a7
MD5 hash:	9d39348ca28e1a39cc6399aa05b42411
humanhash:	grey-black-bakerloo-sweet
File name:	9d39348ca28e1a39cc6399aa05b42411.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	275'968 bytes
First seen:	2024-04-22 16:10:20 UTC
Last seen:	2024-04-22 16:34:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d10268a82f0ec0b09c4d5e18431c41e9 (21 x Stealc, 2 x LummaStealer, 1 x Arechclient2)
ssdeep	3072:SWTuVgLzUoZn7oa0LaEYts6BETBS0+x25JtLbC7J:DuVgfZka0LxGsqSj+xytkJ
TLSH	T18844AE1136F3AC76D566FA304D2BCAF4262EB8315E60B68B7704177F5E302E39626316
TrID	46.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 25.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 8.5% (.EXE) Win64 Executable (generic) (10523/12/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	64d29a9899a9a991 (1 x Stealc)
Reporter	abuse_ch
Tags:	exe Stealc

abuse_ch

Stealc C2:
http://185.172.128.111/f993692117a3fda2.php

Intelligence

File Origin

# of uploads :

# of downloads :

312

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Connecting to a non-recommended domain

Connection attempt

Sending an HTTP GET request

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Verdict:

No Threat

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint

Link:

https://www.filescan.io/uploads/66268c1a75339da04f9bd147/reports/46d79a21-9917-4eff-a47e-21c97369472e/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c5e9df1d-d716-427d-9531-6ca4026f1d4d

Result

Threat name:

Mars Stealer, Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1429811

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Snort IDS alert for network traffic

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891/

Threat name:

Win32.Spyware.Stealc

Status:

Malicious

First seen:

2024-04-22 16:11:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n22gsozkglrclkeltpaizdaomcoeomitefhunqeoj7agp7zx5ciq._file

Verdict:

malicious

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc stealer

Link:

https://tria.ge/reports/240422-tmxe5add51/

Behaviour

Program crash

Stealc

Unpacked files

SH256 hash:

743875dcc496b10bc3b30df93f050fc7660b19a0125046769fcb5eb9166d62b9

MD5 hash:

3d508dd52445d80003ea8f82924983ed

SHA1 hash:

87573bf07f77149fd531082018f784992b183795

Detections:

stealc

win_stealc_auto

Link:

https://www.unpac.me/results/ae8a2388-8455-4d0d-8188-8d29f8729041/

Parent samples :

1a102b793f4cad2e1bffc0a7e25ffd3601744a616d19f7f5dbd57c8a116538b3
9bef7a636bd52f5ecd74c1f4041c73eefad5e23f8a978af0201f72cd24a9b0d0
fb63921ce0bda58d6277755b5e784e7b042f646d64ebbd230a6b9b8ab3db33d7
a4805aa4e8b2cb5956f757d210eaa3cd8d14b9f882f483473b1c5cc9c64c441d
1418981255cd087e37c0995615e09d0e969a1adafc29f7995156e0b1d4c40285
6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891
d5dbffe347a31cc50559e0c91f94f47fa1f134d3678c7721685af1bdf84be133
2daf90fbe9e99b9e0378f48a8b091fa703b735760ebf32ce609b40d4648a955e
8d8e0734ba1d608ef6ee124b1d5ab196223f6eb1d50348d1eb0b6ae57cd8ad3a
4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae
0a6e0a8505b349359dc63cc92fc46f879f19f43c246eb7e2445dcaca526d70fb
4d8b8c49b376c483e08d172646b49baf697d54b815b8357008117fed39c92cb0
c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0
cb664fc08a69a03e1d7ad2d47b9d7397330601fcfd8d559149ee606d782f14ad
dadc6e78d7628c9b004c60834d4f20729bf6718b972c31ef08c3bb7181a39a7f
6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8
a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3
1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f

SH256 hash:

6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891

MD5 hash:

9d39348ca28e1a39cc6399aa05b42411

SHA1 hash:

a60a633f92a6631ffd21d7f11457319d5897c5a7

Link:

https://www.unpac.me/results/ae8a2388-8455-4d0d-8188-8d29f8729041/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6eb4693b2a32/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Mars_Stealer Create hunting rule
Author:	@malgamy12
Description:	detect_Mars_Stealer

Rule name:	infostealer_win_stealc_standalone Create hunting rule
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	malware_Stealc_str Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	Stealc infostealer

Rule name:	Windows_Trojan_Generic_2993e5a5 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Stealc_b8ab9ab5 Create hunting rule
Author:	Elastic Security

Rule name:	win_stealc_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.stealc.

Rule name:	win_stealc_w0 Create hunting rule
Author:	crep1x
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2810818/

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2754939/

URLhaus

https://urlhaus.abuse.ch/url/2812849/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::FindNextVolumeW KERNEL32.dll::SetFirmwareEnvironmentVariableA KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetVolumeInformationW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleA KERNEL32.dll::WriteConsoleW KERNEL32.dll::SetConsoleDisplayMode KERNEL32.dll::SetConsoleTitleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleAliasExesLengthA KERNEL32.dll::GetConsoleAliasesLengthA KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample