MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 774a5633a5cf948de71702480044e7466daaaea595d4149c2414cb995b7c3378. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MarsStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 6 File information Comments

SHA256 hash:	774a5633a5cf948de71702480044e7466daaaea595d4149c2414cb995b7c3378
SHA3-384 hash:	05d36ee95504d50c0c25a905c04c2de18f76911a194382c8e04a7759b7cf0ccec593c225d38670fd5f23823d76b37f62
SHA1 hash:	3aea6ba93db4033ece0616151c0ff5abf77e765b
MD5 hash:	daaea0525ee1d9c24d5cac8ea344a6d3
humanhash:	comet-hotel-angel-autumn
File name:	file
Download:	download sample
Signature	MarsStealer Create hunting rule
File size:	289'792 bytes
First seen:	2023-09-26 18:15:05 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ad179eb8d009622c95c11c2ffa3cbf38 (2 x Smoke Loader, 1 x MarsStealer, 1 x RedLineStealer)
ssdeep	3072:UdIj/mcmcWchdfT9vUE8i5luhFCeP1lxE0ZfAK1cptLQCV:iIj/VmtMdfJ8E8i5EfC41bE6fMj
Threatray	2 similar samples on MalwareBazaar
TLSH	T1EC54AF13B3E1BC31E4768A319D3AC2B47B2EB5604E7967AF33545A2B09B11E1CA77701
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	0032202252502451 (1 x MarsStealer)
Reporter	andretavare5
Tags:	exe MarsStealer

andretavare5

Sample downloaded from http://christopherantonio.top/calc2.exe

Intelligence

File Origin

# of uploads :

# of downloads :

280

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-09-26 18:16:10 UTC

Tags:

stealc stealer

Link:

https://app.any.run/tasks/ec8ca288-27c3-4a29-a614-2b80edef5f16

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/451328/

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.25970.4219.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Launching the default Windows debugger (dwwin.exe)

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/65131fe31edabd9982a076ad/reports/b78f773f-5300-48ec-9e02-285de5f91a36/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/774a5633a5cf948de71702480044e7466daaaea595d4149c2414cb995b7c3378

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Oski Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/89fcba68-41cc-448b-987e-346c6f5c0b98

Result

Threat name:

Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1314747

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/774a5633a5cf948de71702480044e7466daaaea595d4149c2414cb995b7c3378/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2023-09-26 17:41:24 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

29 of 37 (78.38%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=o5ffmm5fz6ki3zyxajeaarhhizw2vlvfsxkbjhbectfzsw34gn4a._file

Verdict:

malicious

MarsStealer

b2aa1408b77d5272d0e9f7250e196124fd2cc5d86f8ef90abe0ec37ea27b41af

MarsStealer

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc discovery spyware stealer

Link:

https://tria.ge/reports/230926-wwfj3sdh58/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Stealc

Malware Config

C2 Extraction:

http://bryanzachary.top

Unpacked files

SH256 hash:

fe6edbc42a1b391d80eac4c06b5dd169cebbc353f67a6e1d780770be829ce27e

MD5 hash:

7b1a0ddf9afe48ddd7a79a9c3964f353

SHA1 hash:

db3922ddda9702a979090b50cd640521ce0eed99

Detections:

stealc

Link:

https://www.unpac.me/results/6271e57f-74d2-42cd-946f-22c83c05c213/

Parent samples :

926bb9311b6d628c34e16f770695418656be7158d16b412c5954faa74ff57fbe
b2aa1408b77d5272d0e9f7250e196124fd2cc5d86f8ef90abe0ec37ea27b41af
774a5633a5cf948de71702480044e7466daaaea595d4149c2414cb995b7c3378
09d0c1b8d3b4e342f35326bc754e7a05ac3b31fed0c60a86477a4336554059f4
576ae20ecf51decbf1e8a5a934975b451f8a11e03766928535a49e70c368175b

SH256 hash:

774a5633a5cf948de71702480044e7466daaaea595d4149c2414cb995b7c3378

MD5 hash:

daaea0525ee1d9c24d5cac8ea344a6d3

SHA1 hash:

3aea6ba93db4033ece0616151c0ff5abf77e765b

Link:

https://www.unpac.me/results/6271e57f-74d2-42cd-946f-22c83c05c213/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/774a5633a5cf/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/774a5633a5cf948de71702480044e7466daaaea595d4149c2414cb995b7c3378

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Mars_Stealer Create hunting rule
Author:	@malgamy12
Description:	detect_Mars_Stealer

Rule name:	infostealer_win_stealc_standalone Create hunting rule
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	win_stealc_w0 Create hunting rule
Author:	crep1x
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/