MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81628e4300b6cebde33d6cfbee5f483d230216616b812e6896aa159d77b0c081. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	81628e4300b6cebde33d6cfbee5f483d230216616b812e6896aa159d77b0c081
SHA3-384 hash:	a62ca9eaba717687f1644819f925d3165718f32fbd2ae25343a9557d89a90ab10aaaf94e35afea7ee88ed8667bfaf011
SHA1 hash:	014744d39e97eb09f939156fa42d847fa7f8e1c2
MD5 hash:	51f6d19122dc22ce10fbd99b2581726f
humanhash:	venus-mississippi-wyoming-delta
File name:	51f6d19122dc22ce10fbd99b2581726f.exe
Download:	download sample
Signature	Stealc Alert Create hunting rule
File size:	319'488 bytes
First seen:	2023-12-24 08:19:15 UTC
Last seen:	2023-12-24 10:14:18 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8b28cd44b80d6c5bb369f5c5fed7023a (1 x Stealc, 1 x Smoke Loader)
ssdeep	6144:5aQjstxsKLqh6IbxHpSZeKfIvc22s34fM1o22fEutV:5Hjs0K0bxJhpU2IM+FfEMV
TLSH	T18B648C2172E0E032D7E719714674C7FA4A7B74325825D5AFB6D02AB91E21FF1AB2130E
TrID	46.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 25.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 8.5% (.EXE) Win64 Executable (generic) (10523/12/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	d2b1e4d4ecb9c7f9 (6 x Smoke Loader, 6 x Stealc, 5 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe Stealc

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

294

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/469182/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.PWS.Siggen3.35217.16974.24050.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Reading critical registry keys

Changing a file

Creating a file in the %AppData% subdirectories

Creating a window

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Stealing user critical data

Sending an HTTP GET request to an infection source

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed stealc

Link:

https://www.filescan.io/uploads/6587e9b5a6bc59352f2eb9f5/reports/efa41c53-6149-40d4-a940-eb49fae5a0ad/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/81628e4300b6cebde33d6cfbee5f483d230216616b812e6896aa159d77b0c081

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Stealc

Malware family:

Stealc

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/a617d56a-1418-4c6e-af41-a691349c4a42

Joe Sandbox Stealc, Vidar

Result

Threat name:

Stealc, Vidar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1366646

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/81628e4300b6cebde33d6cfbee5f483d230216616b812e6896aa159d77b0c081

CERT.PL MWDB stealc

Detection:

stealc

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/81628e4300b6cebde33d6cfbee5f483d230216616b812e6896aa159d77b0c081/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-23 19:00:24 UTC

File Type:

PE (Exe)

Extracted files:

40

AV detection:

21 of 37 (56.76%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qfri4qyaw3hl3yz5nt564x2ihurqeftbnoas42ewvikz255qycaq._file

Threatray malicious

Verdict:

malicious

Hatching Triage stealc

Result

Malware family:

stealc

Alert

Create hunting rule

Score:

  10/10

Tags:

family:stealc discovery spyware stealer

Link:

https://tria.ge/reports/231224-j8er4adge9/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Stealc

Malware Config

C2 Extraction:

http://77.91.76.36

UnpacMe stealc win_stealc_auto win_stealc_a0 win_stealc_bytecodes_oct_2023

Unpacked files

SH256 hash:

7fdbfde21e6a9f34966dcbf2c4f008f7c13a52385852aad40e0485c23ec6b614

MD5 hash:

fadec2f496629ad87cfbb9a2a7f5446d

SHA1 hash:

da783e5c9568589655760aea863def2b5df5342a

Detections:

stealc

Alert

Create hunting rule

win_stealc_auto

Alert

Create hunting rule

win_stealc_a0

Alert

Create hunting rule

win_stealc_bytecodes_oct_2023

Alert

Create hunting rule

Link:

https://www.unpac.me/results/7bd97afa-91ed-4cc2-8551-79d530688751/

Parent samples :

e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683
7eda35b2c10d5bbc286d3f446c142758783aea0535b55c9dd42968d35ca202fa
fa6ba41bff46096cf24102217650b7a3190a5b7ae13f0c69c96bb38f726014f5
81628e4300b6cebde33d6cfbee5f483d230216616b812e6896aa159d77b0c081
bbc7dd5d471b06ed6e6f3ee03bef18e6967cf244bbc1ede6af795de22aaad6a9

SH256 hash:

81628e4300b6cebde33d6cfbee5f483d230216616b812e6896aa159d77b0c081

MD5 hash:

51f6d19122dc22ce10fbd99b2581726f

SHA1 hash:

014744d39e97eb09f939156fa42d847fa7f8e1c2

Link:

https://www.unpac.me/results/7bd97afa-91ed-4cc2-8551-79d530688751/

VMRay Stealc

Malware family:

Stealc

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/81628e4300b6/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/81628e4300b6cebde33d6cfbee5f483d230216616b812e6896aa159d77b0c081

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 81628e4300b6cebde33d6cfbee5f483d230216616b812e6896aa159d77b0c081

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2736472/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/469182/