MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77f9b87268ce558c0ca79ba82838f02ab8a6c49f1d3f1ae8a442cdca9fd4d257. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 3

Intelligence 3 IOCs YARA 11 File information Comments

SHA256 hash:	77f9b87268ce558c0ca79ba82838f02ab8a6c49f1d3f1ae8a442cdca9fd4d257
SHA3-384 hash:	a4de59e5dca10243e2864d72944f4830c7991de37e549a35fc02ff4475dfab768224bcc8689613c204c8df60de93a875
SHA1 hash:	98f482811ab9d31ec3a418ea406cc7acc0660033
MD5 hash:	be1713a9214819771aed9cbbed30cfab
humanhash:	eight-gee-muppet-dakota
File name:	Setup_File_69.613.5190.zip
Download:	download sample
Signature	Stealc Create hunting rule
File size:	40'653'147 bytes
First seen:	2026-05-14 23:28:22 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: 2026
ssdeep	786432:3aX0BZPZKwVRu1OlLLA8YiEo2ecpFXEepDBNYqGY4CHN7F0IF5NSKAtLDpJZX2WQ:3akBtZKMRblufjpFXJpfYXCH1F5AKOLq
TLSH	T18E97334D34EF2568D2B49E9878D5E1033A117F4F0E7FD30727BA9669F300A1889497BA
Magika	zip
Reporter	aachum
Tags:	178-16-55-25 file-pumped pw-2026 Stealc zip

iamaachum

https://dnssearcheer.online/gt/

Stealc Build ID: RRR0506
Stealc C2: http://178.16.55.25/bcbb13c7c8984290857b.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file is a password protected archive. The password is: 2026

This file archive contains 2 file(s), sorted by their relevance:

File name:	Setup_File_56.171.9039.exe
File size:	3'567'528 bytes
SHA256 hash:	41999a3d0da035ff8068905c90235ea50121329cb0661e38d745974ebf5e3ae2
MD5 hash:	cf64c7e2e3897ae5fce3d5414e3d1d27
MIME type:	application/x-dosexec
Signature	Stealc

File name:	borlndmm.dll
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	130'720'640 bytes
SHA256 hash:	09016877719ec5a31be968d0fe211e900d9ce3aa1a212c84cf9ddf623a0336e0
MD5 hash:	2ec5128a34659d358037f2cf7c5f8140
De-pumped file size:	52'720'640 bytes (Vs. original size of 130'720'640 bytes)
De-pumped SHA256 hash:	a1199a96dfe81728445262b8212e35dcc055131dedd8209bca5929b82574b3b0
De-pumped MD5 hash:	00809f53bdcc93d1464bd94ea076a820
MIME type:	application/x-dosexec
Signature	Stealc

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/45c934b2-cdb4-4cd0-b9b0-d6336528771e/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a065ab046d6967b3d9060a8

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/77f9b87268ce558c0ca79ba82838f02ab8a6c49f1d3f1ae8a442cdca9fd4d257

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/77f9b87268ce558c0ca79ba82838f02ab8a6c49f1d3f1ae8a442cdca9fd4d257

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/77f9b87268ce558c0ca79ba82838f02ab8a6c49f1d3f1ae8a442cdca9fd4d257/results?tab=lookup

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o743q4tizzkyydfhtoucqohqfk4knre7du7rv2feilg4vh6u2jlq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Any_SU_Domain Create hunting rule
Author:	you
Description:	Detect any reference to .su domains or subdomains

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_all_IPv6_variants Create hunting rule
Author:	Bierchermuesli
Description:	Generic IPv6 catcher

Rule name:	goLangMatch3 Create hunting rule

Rule name:	goLangMatch4 Create hunting rule

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/