MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 897a17219c089cfd40d9bd5608d3a6a8d3e743913887477afa0672dc8425442b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 16

Intelligence 16 IOCs YARA 1 File information Comments

SHA256 hash:	897a17219c089cfd40d9bd5608d3a6a8d3e743913887477afa0672dc8425442b
SHA3-384 hash:	d01f2c7e235d883fe2765fd952a604c67f3aa868025f2e6351b40a0078d0afea8e7f447a4eff879d0d91f2dce560cf66
SHA1 hash:	f68d2a0259f15b92da5d7325eee1ab2a7d323c4c
MD5 hash:	24a7d43b55f483cd305b75e9e216ed4f
humanhash:	december-oregon-indigo-nineteen
File name:	24a7d43b55f483cd305b75e9e216ed4f.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	208'384 bytes
First seen:	2023-09-22 05:40:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ded5f9b2aac3deaaecd03f5d6740865e (2 x Stealc, 2 x Smoke Loader)
ssdeep	3072:FXJBQkp454Cho1cEvTjZqXyTquN/Q6L51ZGpVzaC:BLQG4GChEcEvLqdsZKp
Threatray	5'870 similar samples on MalwareBazaar
TLSH	T18514D01178E2C172D1AB44709831CBA46E7BBC736375844B3798277EAE707D29FA6342
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	020404010a083000 (1 x Stealc)
Reporter	abuse_ch
Tags:	exe Stealc

abuse_ch

Stealc C2:
http://193.168.141.163/4b91eb784a77478c.php

Intelligence

File Origin

# of uploads :

# of downloads :

281

Origin country :

Vendor Threat Intelligence

Malware family:

smoke

ID:

File name:

24a7d43b55f483cd305b75e9e216ed4f.exe

Verdict:

Malicious activity

Analysis date:

2023-09-22 09:11:29 UTC

Tags:

loader smoke opendir lumma

Link:

https://app.any.run/tasks/920431d6-8042-434b-86d1-0aa76df05a99

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

SmokeLoader

Link:

https://www.capesandbox.com/analysis/450550/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/650d28ee0870810f01842f66/reports/8bb69683-77c9-4e45-83f8-fc93d4eca2f7/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/897a17219c089cfd40d9bd5608d3a6a8d3e743913887477afa0672dc8425442b

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7c34c894-908e-48d4-ab42-cde08faaca0d

Result

Threat name:

SmokeLoader, Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1312747

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contain functionality to detect virtual machines

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses cmd line tools excessively to alter registry or file data

Uses ipconfig to lookup or modify the Windows network settings

Yara detected Costura Assembly Loader

Yara detected SmokeLoader

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/897a17219c089cfd40d9bd5608d3a6a8d3e743913887477afa0672dc8425442b/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2023-09-22 05:41:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 23 (86.96%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rf5boim4bcop2qgzxvlaru5gvdj6oq4rhcduo6x2azznzbbfiqvq._file

Verdict:

malicious

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:up4 backdoor persistence trojan

Link:

https://tria.ge/reports/230922-gde39sdf2w/

Behaviour

Checks SCSI registry key(s)

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of SetThreadContext

Deletes itself

Modifies Installed Components in the registry

SmokeLoader

Malware Config

C2 Extraction:

http://host-file-file0.com/
http://file-file-file1.com/

Unpacked files

SH256 hash:

de05cc8de34dab9dda57ad7930c5db793daa0f982c4190c390458453046de280

MD5 hash:

ffb6cf7e4db29a42928a3d5235f2856f

SHA1 hash:

da3cfa237ce4caf7453a846479f22dc628bb85d0

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/0064f545-ef79-4f05-8842-569e0e9cd690/

Parent samples :

effcecaddb031e10ad3e6e64caec3d0ab53aa774c98ae4cb9abd07be19be534f
78bad359d0652879dec380fee12b68cc4e14e4f63f8c4e23e7b75bb5338d5924
4bdfd777b579da177959f5854c16f8201e1501e0cf9394f4cfef13cd999fb9d9
69d090774ce99b248f9e76d50312cfcbc7cc8c333f390a0fdffc95f62d7a9631
a173a882ba5f24ab2de4f0df9f41ae2469602e4bbb39c36d0b5327fdf6889608
7c311a6be00d9c513752760c26d44ea69159a222f4d9719629342e4cc157ac90
00d9091fb924eb9f0c28426aa95eaeb9b398fe50395b27a105bcf7f77039d842
9b14723319d814a4f65cfd2be879357aff8d36c2f0d06f0ae078f2e6fe0b0aa4
f44f6beb65cef160220c123ff6a1f4d4583067ee69917ff4b72390246744afad
0f65a5317331c174d6552f48a689cdc40a5483c89ff883687746bbf734c49066
897a17219c089cfd40d9bd5608d3a6a8d3e743913887477afa0672dc8425442b
e6199c29d7656617e794d4ecd836601db0dae5999e9b6fe7eb30a50f76df0d21
9ceb194336ec1a3fdbb61a700ee3efb3711ff53abc67b2d189c424e05dca10d5
3bf1e0c1abce523127ad4b80bbd48d048a5cdf974e8da3ceb480663c29526c2e
40e5bc9c2cb5765b89ab2762e4dc93739fc998e9c0ff3ea1540c7743d20990b7
d6cb6875d5f777dea91f695019b44aad3ae4e841afb9a1dd14d8118983003b64
baa08ba27f8ef8c024eba8647a05d3bc85f194e917630ba532913156677502c8
d3bdf4701a38136c40e6d2580133f8cf6bbc080c3129b506b14b8f1d94488720
c2b6ad06d03c1384b2cb7270d4f2d587e823d64c1312364273a17c721f27ae83
afaf73afdd2ecbb34ff36e0a4e5e31dddfcbe593185af268d745ee3d7bfd45b2
a9b29bf0ebe50be5cfab4fc65f878426c2135cbdb1043d3a6123a84cab2e25be
83a8d29698443f1eeac7b66c746d8327b7185c03ca9cd9c9f6eb0e8133bfc957
fc20ca011adae9fe17732346f7958050f5830d782b71ec20e59df189abdd687d
6396c6ec85f9181ea7943b484ee8d9d0e313f7d408d8c1523f16102c9ede62b1
86a45c0d829cb99ee7b76081fc47c17a9072fd4bccdc791d67b1be528a0351d2
f203266977b3d854f5b06d8012bf2e5cc84df25a74a4de4dda92b964e4cde385
cc1ab7eef4eb1f7568b6d3fe705eef6da66e8f0fd907405b15501338322f5aee
ba79a24332244508a959ad716795cc8a170483415d97dd2dd8adac384b333fb0
0e1c1f54576e5ea6f024852228ef877537849db15a46633d77e36d8439e9609a
b084dabc65fb7141290d3140652878ee0d61c1225ef9dbb14393d04d58ea7e8d
e5abfd586023d463703d58cc19a892bdaf409ae4d48e3db6fe9e4678e69f8110
b7d941306629e560107c3534ab248d069eb60270a65c5c487bcd18072ff535e1

SH256 hash:

897a17219c089cfd40d9bd5608d3a6a8d3e743913887477afa0672dc8425442b

MD5 hash:

24a7d43b55f483cd305b75e9e216ed4f

SHA1 hash:

f68d2a0259f15b92da5d7325eee1ab2a7d323c4c

Link:

https://www.unpac.me/results/0064f545-ef79-4f05-8842-569e0e9cd690/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/897a17219c08/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/897a17219c089cfd40d9bd5608d3a6a8d3e743913887477afa0672dc8425442b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.