MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 15

Intelligence 15 IOCs YARA 27 File information Comments

SHA256 hash:	7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8
SHA3-384 hash:	7f6555522ed1a31b7bd0112d7296fee36dba97f669c83c17b43550419f51811000612daa2c30c131be9d05c826207ca8
SHA1 hash:	0022f9fdb324273e5fb2fb32b6c0757e1c6a6624
MD5 hash:	4006989ca09bc4d0021fd723a96d4577
humanhash:	king-arizona-gee-magnesium
File name:	y79nkyr.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	4'991'488 bytes
First seen:	2026-05-02 11:44:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4029dc5ee830151a426fff64189bae0e (7 x Stealc, 2 x RedLineStealer, 1 x SVCStealer)
ssdeep	49152:9eQRVsxa2kMOnYUvPbGP/+926/AAqsRXXY:jJ2vwKPv0
Threatray	15 similar samples on MalwareBazaar
TLSH	T10536391373254FACF0CA81B6B128EE2486F1F709B52B6A7769F01E153E43560DD5BA38
TrID	70.9% (.EXE) InstallShield setup (43053/19/16) 10.7% (.EXE) Win64 Executable (generic) (6522/11/2) 8.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.3% (.EXE) OS/2 Executable (generic) (2029/13) 3.3% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	55ccccc8c4cccc55 (1 x RedLineStealer, 1 x Stealc, 1 x VenomRAT)
Reporter	BastianHein
Tags:	exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

174

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

ConfuserEx Diamotrix LocalBinder Optimal RoboSki Stealc TinyLoader

Details

TinyLoader

xor decoded strings including cryptocurrency addresses and a c2 url

Link:

https://research.acce.ciphertechsolutions.com/results/aa09677b-2c0d-4b04-a76c-e488a765b003/

Malware family:

amadey

ID:

File name:

x7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8.exe

Verdict:

Malicious activity

Analysis date:

2026-05-02 11:37:27 UTC

Tags:

stealc stealer auto-reg amadey botnet

Link:

https://app.any.run/tasks/69e9dd5e-2319-4200-922a-59fdc1cb0897

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/64276/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% directory

Creating a process from a recently created file

Сreating synchronization primitives

Creating a file in the %temp% directory

Enabling the 'hidden' option for files in the %temp% directory

Creating a file

Enabling the 'hidden' option for recently created files

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Creating a service

Loading a system driver

Creating a file in the %AppData% subdirectories

DNS request

Searching for synchronization primitives

Connection attempt

Launching the default Windows debugger (dwwin.exe)

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Connection attempt to an infection source

Unauthorized injection to a recently created process

Enabling autorun for a service

Blocking the Windows Defender launch

Blocking the Windows Security Center launch

Forced shutdown of a system process

Unauthorized injection to a system process

Sending an HTTP POST request to an infection source

Changing the hosts file

Enabling autorun by creating a file

Verdict:

Malicious

Labled as:

Trojan_Win64_SvcStealer_PGSL_MTB

Link:

https://www.hybrid-analysis.com/sample/7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-05-01T03:55:00Z UTC

Last seen:

2026-05-04T09:09:00Z UTC

Hits:

~100

Detections:

Trojan.MSIL.BypassUAC.sb Trojan-PSW.Win32.Agent.sba Trojan.Win32.Agent.sb HEUR:Trojan.Win64.Generic Trojan-Dropper.Win32.Agent.sb VHO:Trojan-PSW.Win32.Stealer.gen PDM:Trojan.Win32.Generic Trojan.Win64.Agent.sb Trojan-PSW.Win64.StealC.sb Trojan-Dropper.Win32.Injector.sb HEUR:HackTool.Multi.AmsiETWPatch.gen VHO:Trojan-PSW.Win32.StealC.gen BSS:Trojan.Win32.Generic HackTool.Multi.AmsiETWPatch.sb Trojan.Win32.BypassUAC.sb Backdoor.Agent.HTTP.C&C Trojan-PSW.Win32.Coins.sb Trojan.Win64.Agentb.sb Trojan.Win64.Agent.smgcbx Trojan.Win64.Agent.gen Trojan-Banker.Win32.ClipBanker.sb Backdoor.Win32.Zegost.sb Backdoor.Win32.Androm.sb Trojan.Win32.Injuke.poor Trojan.Win32.Agent.xcdpxi Trojan-PSW.Win32.StealC.v2 Trojan-Dropper.Win32.Dapato.sb VHO:Trojan.Win64.Agent.gen Trojan-Downloader.Win32.Dapato HEUR:Trojan.Win64.Agent.gen.ia HEUR:Trojan.Win32.Agentb.gen HEUR:Trojan-Banker.Win32.ClipBanker.gen Trojan.Win32.Inject.sb Trojan-PSW.Win32.Stealer.sb VHO:Trojan-Dropper.Win32.Dapato.gen VHO:Trojan.Win32.Agent.gen

Link:

https://opentip.kaspersky.com/7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8/results?tab=lookup

Gathering data

Score:

95%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8/

Verdict:

Malicious

Threat:

Family.VALLEYRAT

Link:

https://tip.neiki.dev/file/7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8

Threat name:

Win64.Trojan.SvcStealer

Status:

Malicious

First seen:

2026-05-01 12:30:12 UTC

File Type:

PE+ (Exe)

Extracted files:

132

AV detection:

23 of 36 (63.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pa3pz63mqhrdin73dnhiciezvfc74mmohxcbzm52qh4xndanbw4a._file

Verdict:

malicious

Label(s):

stealc

unc_clipper_003

Stealc

1a3b31b13826aa5ecd6629afafa5d3e08f308617f0be75aab590d21cfdb7bc8f

Stealc

2e8931e43c5674bc641651868ef311e2d3407e0132325c0795bdf4f5404fb30f

Stealc

5d4db2e3cac1da48ae87df7ab46f6a9b527922b4785da87851314d16a77d9e08

Stealc

error

Stealc

+ 5 additional samples on MalwareBazaar

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc botnet:mkaysnkmka4g1igb04jt botnet:run discovery persistence spyware stealer

Link:

https://tria.ge/reports/260502-nw4b5shx9j/

Behaviour

Checks processor information in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Reads WinSCP keys stored on the system

Reads user/profile data of web browsers

Sets service image path in registry

Detects Stealc stealer Version 2

Family: Stealc

Malware Config

C2 Extraction:

http://196.251.107.130

Unpacked files

SH256 hash:

7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8

MD5 hash:

4006989ca09bc4d0021fd723a96d4577

SHA1 hash:

0022f9fdb324273e5fb2fb32b6c0757e1c6a6624

Link:

https://www.unpac.me/results/a480f5b2-1e2b-4c44-a948-fcb02b0b9fd4/

SH256 hash:

f054ad80b1d7b83b053e338281341855990fa8ab3c55e3d20f3e4be96bcda6c4

MD5 hash:

3f5118efeadf681bac4f2029e6430218

SHA1 hash:

084463a99e913621b09b2d2776e557971ec9c681

Detections:

INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Link:

https://www.unpac.me/results/a480f5b2-1e2b-4c44-a948-fcb02b0b9fd4/

SH256 hash:

29424e373c61d8dc1bbca9a142771f2dc66f315bf2ff22836c73f9e1699119b2

MD5 hash:

cb5b08590e12fb0d823498d7d7f15d12

SHA1 hash:

4d5090adcdf19139cbe5f911deeb36bfc77bde94

Detections:

ReflectiveLoader

INDICATOR_SUSPICIOUS_ReflectiveLoader

Link:

https://www.unpac.me/results/a480f5b2-1e2b-4c44-a948-fcb02b0b9fd4/

Parent samples :

7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8
924d04927474d82bb9c31bd75bfa01a15746460d201d682ad4155c116a635dd0

SH256 hash:

f769c6c7fc0b250bf3b40ec9dad20c21d34694a2eb354bc75c19d40c16137185

MD5 hash:

a42cbfb70007789c48a263251360fe4e

SHA1 hash:

49c60ea8b04d329c3994a19d42d5e174c5d96d31

Detections:

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

INDICATOR_EXE_Packed_ConfuserEx

Link:

https://www.unpac.me/results/a480f5b2-1e2b-4c44-a948-fcb02b0b9fd4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7836fcfb6c81e23437fb1b4e812099a945fe318e3dc41cb3ba81f9768c0d0db8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	grakate_stealer_nov_2021 Create hunting rule

Rule name:	Heuristics_ChromeABE Create hunting rule
Author:	Still
Description:	attempts to match instructions related to Chrome App-bound Encryption elevation service; possibly spotted amongst infostealers

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender Create hunting rule
Author:	ditekSHen
Description:	Detects executables embedding registry key / value combination indicative of disabling Windows Defender features

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM Create hunting rule
Author:	ditekSHen
Description:	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Rule name:	INDICATOR_SUSPICIOUS_ReflectiveLoader Create hunting rule
Author:	ditekSHen
Description:	Detects Reflective DLL injection artifacts

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	StealcV2 Create hunting rule
Author:	Still
Description:	attempts to match the instructions found in StealcV2

Rule name:	SUSP_NET_Shellcode_Loader_Indicators_Jan24 Create hunting rule
Author:	Jonathan Peters
Description:	Detects indicators of shellcode loaders in .NET binaries
Reference:	https://github.com/Workingdaturah/Payload-Generator/tree/main

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Trojan_CobaltStrike_f0b627fc Create hunting rule
Description:	Rule for beacon reflective loader

Rule name:	Windows_Trojan_Stealc_41db1d4d Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/64276/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample