MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76879ab7212540d378168b2564b9f37db4537b50f6dc369c26b647e85c444c57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 15

Intelligence 15 IOCs YARA File information Comments 1

SHA256 hash:	76879ab7212540d378168b2564b9f37db4537b50f6dc369c26b647e85c444c57
SHA3-384 hash:	fa0788a9adf9236e0dd5d0ff6ecfce1962e3e93b54901719bc6069fa9b4995816bc9ff5bb1e9dec84b5ed74aa420198b
SHA1 hash:	32221bd6511f38963b2ffab94f613be21398aa36
MD5 hash:	d7a9fc879fc9b5c6b5b189afb304dade
humanhash:	football-moon-four-eighteen
File name:	d7a9fc879fc9b5c6b5b189afb304dade
Download:	download sample
Signature	Stealc Create hunting rule
File size:	278'016 bytes
First seen:	2023-05-31 07:53:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	da3fdef870d17fb0b828d20b59c7836e (2 x TeamBot, 2 x Stealc, 2 x GCleaner)
ssdeep	3072:A754m4GzHHV83FoePw7K7PkaTFWwbm0PVf3QrzdWX2Hr/OOy0WOW+PybI5j:u5P9zq3FhNFW+m0tEcm71/WR+I6
Threatray	1'365 similar samples on MalwareBazaar
TLSH	T1A6449D1373E1A835E9670A719E2A82B8662FF8714F6567EB335C5A2F0D702E1C672305
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	00c0d4c448040000 (1 x Stealc)
Reporter	zbetcheckin
Tags:	32 exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

226

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

d7a9fc879fc9b5c6b5b189afb304dade

Verdict:

Malicious activity

Analysis date:

2023-05-31 07:57:43 UTC

Tags:

stealc trojan loader stealer

Link:

https://app.any.run/tasks/c78777e7-02ee-4ad4-9ffc-b49668cafa7f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/393934/

Detection(s):

SecuriteInfo.com.Variant.Ser.Zusy.4319.10561.25200.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Creating a file

Reading critical registry keys

Changing a file

Creating a file in the %AppData% subdirectories

Creating a window

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/88773/overview

Behaviour

MalwareBazaar

SystemUptime

MeasuringTime

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

No Threat

Threat level:

2/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6476fd1a4642400a7af8f110/reports/e65647d0-19c4-4d76-b073-081a4a134fe1/overview

Verdict:

Malicious

Labled as:

Ser.Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/76879ab7212540d378168b2564b9f37db4537b50f6dc369c26b647e85c444c57

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6f8ae03e-6854-4acc-957d-d44d7603167e

Result

Threat name:

Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1245825

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/76879ab7212540d378168b2564b9f37db4537b50f6dc369c26b647e85c444c57/

Threat name:

Win32.Spyware.Stealc

Status:

Malicious

First seen:

2023-05-31 07:54:04 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o2dzvnzbevang6awrmswjoptpw2fg62q63odnhbgwzd6qxcejrlq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/230531-jrh37aea6x/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Unpacked files

SH256 hash:

28611b67339f4ca34958b6474b5e7da9bfa6850c8c3b7701410272a6e49f6614

MD5 hash:

917d92f9d26aa4228f42639312c8db9e

SHA1 hash:

03a62d664410eab1787dbac00de4efe7ced5d119

Detections:

win_stealc_w0

win_stealc_auto

win_stealc_a0

Link:

https://www.unpac.me/results/09711d6d-09af-48ec-9024-4e224e85a33f/

Parent samples :

76879ab7212540d378168b2564b9f37db4537b50f6dc369c26b647e85c444c57
2436911de6028f64f426467d1d1b8cd3b50e3c84fca97ac7a2239ec9a1e394b9
320392e748f8128753b6c297ac2beedb2e1fd1d0a3fefddbc212b8a13cceb507
790eeb5febfc4bcc7aa3b14c3dcd81a4fbd00bf727f0c0cd9623e4d3179fad94
06c6faf5b7bdac61e43a64b8e71a53bf7467acafabb460733866a9eab4540109
f2b4c728867bcc659b1f180783aa3c748f2ee95f0d2f6ed2fdc13869b1b9f0ff
35d4d533678078e58d15b4a47ab0774b0c13b2ab24fa35521131663c3f29e93b
e631703a63b03d0bbfe15f325a4031e11ee2780133e8e1661c9aba941e20f46c

SH256 hash:

76879ab7212540d378168b2564b9f37db4537b50f6dc369c26b647e85c444c57

MD5 hash:

d7a9fc879fc9b5c6b5b189afb304dade

SHA1 hash:

32221bd6511f38963b2ffab94f613be21398aa36

Link:

https://www.unpac.me/results/09711d6d-09af-48ec-9024-4e224e85a33f/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/76879ab72125/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/76879ab7212540d378168b2564b9f37db4537b50f6dc369c26b647e85c444c57

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 76879ab7212540d378168b2564b9f37db4537b50f6dc369c26b647e85c444c57

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/393934/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-05-31 07:53:55 UTC

url : hxxp://widowget.top/office_lic.exe