MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8914ea1630012f740ca6a0cf49ae12af8eedf258da990b477bcff2b6afe4fd5d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 13

Intelligence 13 IOCs YARA 10 File information Comments 1

SHA256 hash:	8914ea1630012f740ca6a0cf49ae12af8eedf258da990b477bcff2b6afe4fd5d
SHA3-384 hash:	6e13e3a1af9621cc9f9852ef8fdfd0f42aed21eb21aed838c4eab36e687cdbb88728459e9593d371945c56fce7cb1869
SHA1 hash:	98ffe93b434bebc548e4c73263bf4724a34a0ae2
MD5 hash:	a7be047e27cfe019ade71a4b347efb00
humanhash:	asparagus-november-single-bulldog
File name:	a7be047e27cfe019ade71a4b347efb00
Download:	download sample
Signature	Stealc Create hunting rule
File size:	193'536 bytes
First seen:	2023-09-17 02:35:19 UTC
Last seen:	2023-09-17 05:36:06 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d0d523c12097b517245d838376423429 (1 x RedLineStealer, 1 x Stealc)
ssdeep	3072:n6DdURkMVhMsK9Ecy4CESHUYoRHSkWJoF9FwiK:nGURDK99PS0RlWJo+i
Threatray	346 similar samples on MalwareBazaar
TLSH	T18B147C5370FD8023F0B69476C4145E34B96D6C1FBE23A37F16BB16A9CA00FE5DA21A46
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	zbetcheckin
Tags:	32 exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

305

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/449088/

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.10960.4995.UNOFFICIAL

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

dridex greyware icedid

Link:

https://www.filescan.io/uploads/6506661449c6a4ce497bd098/reports/0615a15e-9f50-412a-a182-bbfea6f58ee6/overview

Verdict:

Malicious

Labled as:

Babar.Generic

Link:

https://www.hybrid-analysis.com/sample/8914ea1630012f740ca6a0cf49ae12af8eedf258da990b477bcff2b6afe4fd5d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3a25d98d-10df-4ddb-a0be-da74b3885c68

Result

Threat name:

Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1309529

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8914ea1630012f740ca6a0cf49ae12af8eedf258da990b477bcff2b6afe4fd5d/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2023-09-16 19:59:05 UTC

File Type:

PE (Exe)

AV detection:

20 of 23 (86.96%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rekoufrqaexxidfgudhutlqsv6ho34sy3kmqwr33z7zlnl7e7voq._file

Verdict:

malicious

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc discovery spyware stealer

Link:

https://tria.ge/reports/230917-c3kmtseh4t/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Enumerates physical storage devices

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Stealc

Malware Config

C2 Extraction:

http://85.209.11.51

Unpacked files

SH256 hash:

9aea77b8db52c6df8d8aebf2ae6c54ede2c1f9f0a0b1d3a6c9e5fa8cd92f7401

MD5 hash:

5e629453a28ec02c3815748e31b617fa

SHA1 hash:

d22f797c44d2bff21fe60b208324769bfc9dc1d5

Detections:

stealc

Link:

https://www.unpac.me/results/b59670c7-45a6-43df-88e6-f61a9f45e281/

SH256 hash:

8914ea1630012f740ca6a0cf49ae12af8eedf258da990b477bcff2b6afe4fd5d

MD5 hash:

a7be047e27cfe019ade71a4b347efb00

SHA1 hash:

98ffe93b434bebc548e4c73263bf4724a34a0ae2

Link:

https://www.unpac.me/results/b59670c7-45a6-43df-88e6-f61a9f45e281/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8914ea163001/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8914ea1630012f740ca6a0cf49ae12af8eedf258da990b477bcff2b6afe4fd5d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Mars_Stealer Create hunting rule
Author:	@malgamy12
Description:	detect_Mars_Stealer

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of MFA browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	infostealer_win_stealc_standalone Create hunting rule
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	win_stealc_w0 Create hunting rule
Author:	crep1x
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/