MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 825772cb107224690e35b423882883bd59349d8942be7448a9024a2aacfab4de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 12


Intelligence 12 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 825772cb107224690e35b423882883bd59349d8942be7448a9024a2aacfab4de
SHA3-384 hash: 24f55acc55a765ba771c90243b8688efa0925f1c3a515748240a2668695e3851b119eb13dd8a02f77d263a1b5f04abe2
SHA1 hash: 55fa5b4e0ba7ebc4318421eac513f7a410617ddd
MD5 hash: ca701ba4a9e99d85a56c5b6635d1ba23
humanhash: fifteen-delta-river-winter
File name:vjuh.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:761'344 bytes
First seen:2025-07-09 01:10:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 112f19f28f55f461c3d7ad7d3898dd7b (30 x Stealc)
ssdeep 12288:HuZwaDq6+/QndPf6fObxi7YiBEqMeY6ReOSoE/+6eM:Howa5+YndPyfKuYcdM7+6e
Threatray 14 similar samples on MalwareBazaar
TLSH T1F5F48D1FF7E501F8C4BB8278CA525946E77A74561370A68F03E019A63F2B6509F7EB20
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter skocherhan
Tags:141-98-6-34 exe Stealc


Avatar
skocherhan
http://141.98.6.34:5554/vjuh.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
28
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_825772cb107224690e35b423882883bd59349d8942be7448a9024a2aacfab4de.exe
Verdict:
Malicious activity
Analysis date:
2025-07-09 01:13:53 UTC
Tags:
stealc stealer
Link:
https://app.any.run/tasks/1321fcb1-a270-4f27-b92d-5a91697a9a0f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/13591/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686dc1bd900df8e7f868c1a3
Tags:
shellcode virus crypt
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Connection attempt
Sending an HTTP POST request
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 cmd fingerprint infostealer lolbin microsoft_visual_cc stealc
Link:
https://www.filescan.io/uploads/686dc1bd469cec4249add0e7/reports/33c237d4-96e7-478e-8538-e25982ef1e82/overview
Verdict:
Malicious
Labled as:
Shellcode.Loader.Marte.X.Generic
Link:
https://www.hybrid-analysis.com/sample/825772cb107224690e35b423882883bd59349d8942be7448a9024a2aacfab4de
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/babf9214-caff-4377-a647-4357319b649c
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/825772cb107224690e35b423882883bd59349d8942be7448a9024a2aacfab4de
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) Win 64 Exe x64
Link:
https://app.malva.re/file/ca701ba4a9e99d85a56c5b6635d1ba23
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/825772cb107224690e35b423882883bd59349d8942be7448a9024a2aacfab4de/
Verdict:
Malicious
Threat:
Win64.Trojan.Stealc
Link:
https://tip.neiki.dev/file/825772cb107224690e35b423882883bd59349d8942be7448a9024a2aacfab4de
Threat name:
Win64.Trojan.Stealc
Create hunting rule
Status:
Malicious
First seen:
2025-07-01 23:32:16 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
27 of 36 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qjlxfsyqoisgsdrvwqryqkedxvmtjhmjik7hisfjajfcvlh2wtpa._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
Similar samples:
4c157555fd7e61dbf6609613e387591fd254724415105e0f205ed58fd1b32a79
Stealc
7282004c0d02019b16529ab753202f521dde539bc58083c3658d459398c6e514
Stealc
825772cb107224690e35b423882883bd59349d8942be7448a9024a2aacfab4de
Stealc
8301936f439f43579cffe98e11e3224051e2fb890ffe9df680bbbd8db0729387
Stealc
972eb5360f4059fa6b11ae78c16bb2e0220d06fdcb4bc99f9b4b1c3bffc28ac8
Stealc
bd395f3593a9c3b08e2d61ad6fe8d3bf43238d918ba14178b5b75d045cb0eec1
Stealc
c3b72389eba306e58381b4a62bce1d04e1071664dc2ec106e06e59a32fb4e54f
Stealc
c6c888cfff95804254c631ce0ccd7abde97f0dda9fc0478ae7327db91ef18a67
Stealc
cb90a725fbbc095fc5748744d044f61642a629167a44cf0ee9680e4532c8363e
Stealc
error
Stealc
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/250709-bj42pask19/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
Verdict:
Malicious
Tags:
Win.Malware.Marte-10045369-0
YARA:
n/a
Link:
https://app.threat.zone/submission/05517d8e-eb9a-4370-884b-82636f57abff
Unpacked files
SH256 hash:
825772cb107224690e35b423882883bd59349d8942be7448a9024a2aacfab4de
MD5 hash:
ca701ba4a9e99d85a56c5b6635d1ba23
SHA1 hash:
55fa5b4e0ba7ebc4318421eac513f7a410617ddd
Link:
https://www.unpac.me/results/c7b4f423-2b19-4dc8-9e76-fd24f77e8a18/
SH256 hash:
2c4651a093a276841935a5b85856ee323d618a60d02162517c9f828c5e3e686d
MD5 hash:
fc1c04e172f708bcfdcaac1d723703bc
SHA1 hash:
12b2a6fc9e88ceba38c90d3a39e09315f1ab93a7
Link:
https://www.unpac.me/results/c7b4f423-2b19-4dc8-9e76-fd24f77e8a18/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/825772cb107224690e35b423882883bd59349d8942be7448a9024a2aacfab4de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:aachum_Stealcv2
Create hunting rule
Author:aachum
Description:Detects new version of Stealc.
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Heuristics_ChromeABE
Create hunting rule
Author:Still
Description:attempts to match instructions related to Chrome App-bound Encryption elevation service; possibly spotted amongst infostealers
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:StealcV2
Create hunting rule
Author:Still
Description:attempts to match the instructions found in StealcV2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

fd5ed13667b42344312e5616bd486f40

Stealc

Executable exe 825772cb107224690e35b423882883bd59349d8942be7448a9024a2aacfab4de

(this sample)

  
Dropped by
MD5 fd5ed13667b42344312e5616bd486f40
Cape
Cape
https://www.capesandbox.com/analysis/13591/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW

Comments