MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 700394f4e1a3d0dbcaf05eec1c9e9c95efc453eea4105ec0d68554021870dd3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 14

Intelligence 14 IOCs YARA 12 File information Comments

SHA256 hash:	700394f4e1a3d0dbcaf05eec1c9e9c95efc453eea4105ec0d68554021870dd3e
SHA3-384 hash:	04b62ba36f584995b3197d0eb02a026c741b57366f13443c27d102ed1e345c7283bcb3cf82237d166a53344fe4406438
SHA1 hash:	26110ae8ae6f519120c7a99516ff55eff36847a6
MD5 hash:	247bfb4193eb3c0835420d0636a5611f
humanhash:	harry-alaska-romeo-missouri
File name:	247bfb4193eb3c0835420d0636a5611f.bin.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	206'408 bytes
First seen:	2023-09-13 17:15:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0c9c64525522b2a989036b9afc41aa0b (1 x Stealc, 1 x RedLineStealer, 1 x LummaStealer)
ssdeep	3072:Xfn5kZl89mwsogl0QyGrnSHUYoRHSkWJoF9FwXeaqly2KNLx1:v5WFogl3rS0RlWJo+XeaqlypND
Threatray	276 similar samples on MalwareBazaar
TLSH	T187147C1370FD8023F4B68476C8585E35BD6D6C1BBE33936F12BB1559CA00FE5E62069A
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	abuse_ch
Tags:	exe Stealc

abuse_ch

Stealc C2:
http://185.244.48.221/753e391766d6b25f.php

Intelligence

File Origin

# of uploads :

# of downloads :

304

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

247bfb4193eb3c0835420d0636a5611f.bin.exe

Verdict:

Malicious activity

Analysis date:

2023-09-13 17:17:51 UTC

Tags:

stealc stealer loader

Link:

https://app.any.run/tasks/909bfec9-5ad0-4d92-b434-6e53b205a2b7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/448468/

Detection(s):

SecuriteInfo.com.Variant.Babar.131148.6877.11454.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Sending an HTTP GET request

Running batch commands

Creating a process with a hidden window

Launching a process

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware masquerade overlay packed stealer

Link:

https://www.filescan.io/uploads/6501ee53985359c8390747c0/reports/88a484eb-ffb7-4fd2-95a2-dd3c47beba18/overview

Verdict:

Malicious

Labled as:

Babar.Generic

Link:

https://www.hybrid-analysis.com/sample/700394f4e1a3d0dbcaf05eec1c9e9c95efc453eea4105ec0d68554021870dd3e

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Oski Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/24f2e1e5-b8fa-43a3-b88d-22d1d5cd4a2d

Result

Threat name:

Stealc

Detection:

malicious

Classification:

troj.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1307961

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Yara detected Stealc

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/700394f4e1a3d0dbcaf05eec1c9e9c95efc453eea4105ec0d68554021870dd3e/

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=oabzj5hbupinxsxql3wbzhu4sxx4iu7ouqif5qgwqvkaegdq3u7a._file

Verdict:

malicious

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc botnet:5670364920616844804777279785 discovery spyware stealer

Link:

https://tria.ge/reports/230913-vs48lagd65/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Stealc

Malware Config

C2 Extraction:

http://185.244.48.221

Unpacked files

SH256 hash:

611cb1d5427023aa4ac8b7b0d1cb1b67ec560a1e482ba99b762fd419ce1121da

MD5 hash:

7163a5ae84083a80f2ab15b2c434a6fa

SHA1 hash:

190f40aef2d5892439e7c4cce9dbc1100b9f8a8a

Detections:

stealc

Link:

https://www.unpac.me/results/cd47341a-dca4-43e8-8452-132ff3f316c4/

SH256 hash:

700394f4e1a3d0dbcaf05eec1c9e9c95efc453eea4105ec0d68554021870dd3e

MD5 hash:

247bfb4193eb3c0835420d0636a5611f

SHA1 hash:

26110ae8ae6f519120c7a99516ff55eff36847a6

Link:

https://www.unpac.me/results/cd47341a-dca4-43e8-8452-132ff3f316c4/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/700394f4e1a3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/700394f4e1a3d0dbcaf05eec1c9e9c95efc453eea4105ec0d68554021870dd3e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Mars_Stealer Create hunting rule
Author:	@malgamy12
Description:	detect_Mars_Stealer

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of MFA browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	infostealer_win_stealc_standalone Create hunting rule
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	win_stealc_w0 Create hunting rule
Author:	crep1x
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	yara_template Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/448468/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample