MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 15


Intelligence 15 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5
SHA3-384 hash: 850c160a7fe0fdb3b8aba93ce11c26d8c038fa548d93daa0f5c84d7ee0348aeb5e0e1f1f2a404ed4ecfb8e52ee35f632
SHA1 hash: f3e260e8699102d2ee43e1c5a99231005438bb69
MD5 hash: a7e899088ee574a2e977080acb00c849
humanhash: magnesium-cola-table-echo
File name:stale.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:4'865'536 bytes
First seen:2024-02-04 06:49:23 UTC
Last seen:2024-02-04 08:23:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 49152:G6+uF3aQ8oal2XJfYGClcSHIib2DszK7GSB2kTRBsx5QgAgZrFTZ:G0dalotJBAcl9TaSBvEx5pTZ
TLSH T162369E02BF95CE12C25D6B33D2D7411453B1D8D26373E74B7AC513A92A0336EDE8E68A
TrID 40.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
31.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
9.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
5.7% (.EXE) Win64 Executable (generic) (10523/12/4)
3.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f0f4d4dce8e0f0f4 (1 x Stealc)
Reporter iamdeadlyz
Tags:194-120-116-120 CVE-2023-27363 exe Stealc


Avatar
Iamdeadlyz
Outfoxing a Malicious PDF: An attacker's attempt to deliver a Stealc infostealer. Exploiting CVE-2023-27363.

Agreement_eSign.pdf drops officeupdate.hta [persisting via startup folder]
Retrieves: hxxps://brazilanimalshelp[.]com/updating/stale.exe
Stealc C&C: hxxp://194.120.116[.]120/7a957ef6cc168ff6.php

Intelligence

File Origin
# of uploads :
2
# of downloads :
365
Origin country :
SG SG
Vendor Threat Intelligence
Detection:
zgRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/474464/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.25863.22342.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed stealc
Link:
https://www.filescan.io/uploads/65bf339b1a072d56526550b5/reports/378fe599-cab0-4da0-b312-62800a2ffc9e/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/61a05145-28dd-4522-ad5a-0754a944bf8b
Result
Threat name:
PureLog Stealer, zgRAT
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1386275
Signature
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected PureLog Stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5/
Threat name:
ByteCode-MSIL.Trojan.ZgRAT
Create hunting rule
Status:
Malicious
First seen:
2024-02-02 15:16:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
10
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qvzvekn5hnvoduggbvb7hyskfps7buq5q637fqa7cm3tybi4qksq._file
Verdict:
malicious
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:stealc family:zgrat rat spyware stealer
Link:
https://tria.ge/reports/240204-hlxhysecal/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Downloads MZ/PE file
Detect ZGRat V1
Stealc
ZGRat
Malware Config
C2 Extraction:
http://194.120.116.120
Unpacked files
SH256 hash:
918942341a02dee31b0163860d265473c2989aa42dada6e9abf3cc3c8cd49283
MD5 hash:
6d3fdb9e9f57a0e76db61fd2577e636e
SHA1 hash:
e21a3c881891194d6583746834cca666d93da9b1
Detections:
stealc
Create hunting rule
win_stealc_auto
Create hunting rule
win_stealc_a0
Create hunting rule
Link:
https://www.unpac.me/results/8e9ff561-4c60-48aa-98b9-b41a92ed2756/
Parent samples :
0ab670958ff796ff74d6871d989032deb5fb1bbb8d2e7269335a330c8dc56038
85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5
SH256 hash:
63366bb58836a4d9fc6a7fb5632ce6aeb52fd2ec57ea5d766b27bfedf7b7deee
MD5 hash:
a6810a5899b5a89ee483c9e94dacb015
SHA1 hash:
c787d081f7534936636b17d94ecee651fd64fdac
Link:
https://www.unpac.me/results/8e9ff561-4c60-48aa-98b9-b41a92ed2756/
SH256 hash:
6a26df7ee49de6fec6c5de1f3f7a94075d2dfbc50922e3b30fd8111f2e734f33
MD5 hash:
f45c1512d5a47375e6e396b4d1111e58
SHA1 hash:
8af036b8c60d10e85cf82212930bb04bc0553f36
Link:
https://www.unpac.me/results/8e9ff561-4c60-48aa-98b9-b41a92ed2756/
SH256 hash:
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
MD5 hash:
544cd51a596619b78e9b54b70088307d
SHA1 hash:
4769ddd2dbc1dc44b758964ed0bd231b85880b65
Link:
https://www.unpac.me/results/8e9ff561-4c60-48aa-98b9-b41a92ed2756/
SH256 hash:
9765294eb0122437c357b6893ae9e6ccba7dfd99db861844bd5a203e311300bb
MD5 hash:
c8c0061b466acee949f532ee4f033d5b
SHA1 hash:
04e53650507d963e81a821a4e65959de474257a8
Link:
https://www.unpac.me/results/8e9ff561-4c60-48aa-98b9-b41a92ed2756/
SH256 hash:
ee5d8d19b12e43459490c9c27024416c670a133fc3f1972fc8f24c6f2b80544c
MD5 hash:
2a3d628b8e04f48a8aea26a687cdc545
SHA1 hash:
e44b4764e00b4e3607f226ab0388403ee785e0bd
Link:
https://www.unpac.me/results/8e9ff561-4c60-48aa-98b9-b41a92ed2756/
SH256 hash:
85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5
MD5 hash:
a7e899088ee574a2e977080acb00c849
SHA1 hash:
f3e260e8699102d2ee43e1c5a99231005438bb69
Detections:
MALWARE_Win_zgRAT
Create hunting rule
Link:
https://www.unpac.me/results/8e9ff561-4c60-48aa-98b9-b41a92ed2756/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/85735229bd3b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:detect_Mars_Stealer
Create hunting rule
Author:@malgamy12
Description:detect_Mars_Stealer
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_zgRAT
Create hunting rule
Author:ditekSHen
Description:Detects zgRAT
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_stealc_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.stealc.
Rule name:win_stealc_bytecodes_oct_2023
Create hunting rule
Author:Matthew @ Embee_Research
Description:Bytecodes present in Stealc decoding routine
Rule name:yarahub_win_stealc_bytecodes_oct_2023
Create hunting rule
Author:Matthew @ Embee_Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

pdf 3779f1b904ee4cf41f4a266505490682559d09337deb30a2cc08793c2e69385c

Stealc

Executable exe 85735229bd3b6ae1d0c60d43f3e24a2be5f0d21d87b7f2c01f13373c051c82a5

(this sample)

  
Link
https://iamdeadlyz.gitbook.io/malware-research/february-2024/outfoxing-a-malicious-pdf-an-attackers-attempt-to-deliver-a-stealc-infostealer
  
Dropped by
SHA256 3779f1b904ee4cf41f4a266505490682559d09337deb30a2cc08793c2e69385c
  
Dropped by
SHA256 84626884775edba43d27869acfe98ce6e7bf687bc1d71fa4a4383d69cfe9d0b6
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/474464/
  
Dropped by
MD5 cfab7a2f5302b8fcdd98159c3c892404
  
Dropped by
MD5 4913fe0e4d17f0a4b18a9acb04c255ac

Comments