MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84fcfdfd2e35991c58ef96c71d56da83f6260ea76f9aab61fc33fc96ed0b9c69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MarsStealer

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	84fcfdfd2e35991c58ef96c71d56da83f6260ea76f9aab61fc33fc96ed0b9c69
SHA3-384 hash:	837e64f3b95c7c8f5e477b0ab058c8a8814cc81d5f88d8c5b1f7e4f372f567a9194a9801fc5ccf0554231c0e876174ff
SHA1 hash:	f122b738fc5b56508e894218ccaa45868e12ef7f
MD5 hash:	b56b86408d89152a981ee399be093c4c
humanhash:	undress-white-fish-queen
File name:	msvcrt.exe
Download:	download sample
Signature	MarsStealer Create hunting rule
File size:	249'856 bytes
First seen:	2022-11-13 02:43:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4e06c011d59529bff8e1f1c88254b928 (29 x MarsStealer, 21 x ArkeiStealer)
ssdeep	3072:U1/E8k9ZjpIn+zNch12KbAwSaSqJSp8/b8EG:y/E8k91rz6/tn8EG
Threatray	461 similar samples on MalwareBazaar
TLSH	T115341938D740F16AD4A200BAC97B8B75ED986B32138950CB53E4E88157355EDBE32C9F
TrID	38.0% (.EXE) Win64 Executable (generic) (10523/12/4) 23.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 16.3% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.EXE) OS/2 Executable (generic) (2029/13) 7.2% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	AndreGironda
Tags:	exe MarsStealer

Intelligence

File Origin

# of uploads :

# of downloads :

298

Origin country :

Vendor Threat Intelligence

Malware family:

arkei

ID:

File name:

msvcrt.exe

Verdict:

Malicious activity

Analysis date:

2022-11-13 02:44:52 UTC

Tags:

arkei

Link:

https://app.any.run/tasks/bee27809-df26-441b-b223-d2a49744d270

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/333096/

Detection(s):

Win.Malware.Vidar-9940468-0

Win.Malware.Lazy-9958170-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Searching for synchronization primitives

Launching the default Windows debugger (dwwin.exe)

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

packed vidar

Link:

https://www.filescan.io/uploads/637059f120a0b4943a8f2993/reports/1d3f5d4c-ee9f-440b-a9d0-8ae3a9e043d6/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Oski Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e3ab4b95-1e7d-447c-9179-49abdbeda79d

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1112056

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

PE file has a writeable .text section

PE file has nameless sections

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/84fcfdfd2e35991c58ef96c71d56da83f6260ea76f9aab61fc33fc96ed0b9c69/

Threat name:

Win32.Trojan.Babar

Status:

Malicious

First seen:

2022-11-13 03:09:26 UTC

AV detection:

21 of 26 (80.77%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qt6p37jogwmrywhps3dr2vw2qp3cmdvhn6nkwyp4gp6jn3iltruq._file

Verdict:

malicious

MarsStealer

27223530f9da259a9f2318b525399a30f5656ca4d2951d76af8039484d8f3e74

MarsStealer

4def4ad12c7aab38e6248c20e211272f1c920a0295c8beda6228543e58c2129c

MarsStealer

7248563d27d6963821e6e2536510681ada58cad62969cfa1f7d835ba1694ad20

MarsStealer

a0fa31bcae15a52955443b7d0c7032cd970b9a52bb3c8642e37c2ea81519832f

MarsStealer

ee52d8834cce35ee8287c44108bd9f6fca35dc7ffa15ec2b699e254c1818ee18

MarsStealer

fcec85746f0f2a92b1268830d6d0b075eb9080707358b93ba5fbd917b1a0a8ea

MarsStealer

+ 451 additional samples on MalwareBazaar

Result

Malware family:

marsstealer

Score:

10/10

Tags:

family:marsstealer botnet:default

Link:

https://tria.ge/reports/221113-c75hssdc8z/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

Malware Config

C2 Extraction:

crypto-land.net/steak/gate.php

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/20cd56ba-aae6-4719-8985-cc22baa504d0

Unpacked files

SH256 hash:

3af5a6678cfb230ffd1665772936b0cb81c5669c794d2acbf07522270985c161

MD5 hash:

7d64cd04acbeb10193ecde99c768e340

SHA1 hash:

622a5d687fd9070a69319d830a2387559b4a1a0f

Link:

https://www.unpac.me/results/59a23489-c352-4ce2-97bf-d4657b6cdb20/

SH256 hash:

84fcfdfd2e35991c58ef96c71d56da83f6260ea76f9aab61fc33fc96ed0b9c69

MD5 hash:

b56b86408d89152a981ee399be093c4c

SHA1 hash:

f122b738fc5b56508e894218ccaa45868e12ef7f

Link:

https://www.unpac.me/results/59a23489-c352-4ce2-97bf-d4657b6cdb20/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/84fcfdfd2e35991c58ef96c71d56da83f6260ea76f9aab61fc33fc96ed0b9c69

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.