MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d00abb9dc2e8161d63530424d10b66ad851ce075be2db66aa7e25cf1883c15f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 14


Intelligence 14 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d00abb9dc2e8161d63530424d10b66ad851ce075be2db66aa7e25cf1883c15f
SHA3-384 hash: 38b185ceb642c0242bd6e853013f1f7323ac3e2b15e4f10f30a48f6b38a202ffdde484e7d688ef308b2a6f16d41541c2
SHA1 hash: c11c5d301fd6de129e8f56f36bcd541d4a185a7a
MD5 hash: 31bf8b85eabcf532de82e0f84b47c4c6
humanhash: mississippi-bacon-fillet-eight
File name:mixar.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:251'664 bytes
First seen:2023-05-22 04:48:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b46b7655f5ed701dbc7075afa681ec5a (5 x RedLineStealer, 1 x Stealc)
ssdeep 6144:oNHR6D0Y0unFQjgnIDLds2cx0CF2dD4HkI:4R6DHnFQsnSBs2W3
Threatray 1'324 similar samples on MalwareBazaar
TLSH T13A34BF227649C076F86B15B944D5DA7599FCB4700BAF01DBEBE04FEE4E50BE1AA30207
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter tcains1
Tags:exe Stealc

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
US US
Vendor Threat Intelligence
Malware family:
oski
Create hunting rule
ID:
1
File name:
mixar.exe
Verdict:
Malicious activity
Analysis date:
2023-05-22 04:44:33 UTC
Tags:
stealc trojan stealer loader oski
Link:
https://app.any.run/tasks/6942d526-ce12-4d78-a5bf-6647fc413a8d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.9555.31881.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Launching a process
Сreating synchronization primitives
Creating a file
Reading critical registry keys
Changing a file
Creating a window
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %temp% directory
Running batch commands
Stealing user critical data
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/87046/overview
Behaviour
MalwareBazaar
MeasuringTime
CPUID_Instruction
CheckScreenResolution
SystemUptime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed stealc
Link:
https://www.filescan.io/uploads/646af43fce1767763969dbc4/reports/7c401dbc-5f17-464f-a3c5-510853aea855/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8d00abb9dc2e8161d63530424d10b66ad851ce075be2db66aa7e25cf1883c15f
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7a0c0ff9-2383-4b9c-969b-e3b1621bd709
Result
Threat name:
Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1239282
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates HTML files with .exe extension (expired dropper behavior)
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 872274 Sample: mixar.exe Startdate: 22/05/2023 Architecture: WINDOWS Score: 100 33 Snort IDS alert for network traffic 2->33 35 Found malware configuration 2->35 37 Antivirus detection for URL or domain 2->37 39 5 other signatures 2->39 8 mixar.exe 1 2->8         started        process3 signatures4 41 Writes to foreign memory regions 8->41 43 Allocates memory in foreign processes 8->43 45 Injects a PE file into a foreign processes 8->45 11 AppLaunch.exe 2 21 8->11         started        15 conhost.exe 8->15         started        process5 dnsIp6 27 193.233.134.93, 49708, 80 FREE-NET-ASFREEnetEU Russian Federation 11->27 29 www-env.dropbox-dns.com 162.125.69.18, 443, 49709, 49710 DROPBOXUS United States 11->29 31 www.dropbox.com 11->31 47 Creates HTML files with .exe extension (expired dropper behavior) 11->47 49 Tries to harvest and steal browser information (history, passwords, etc) 11->49 51 Found evasive API chain (may stop execution after checking locale) 11->51 53 Tries to steal Crypto Currency Wallets 11->53 17 cmd.exe 1 11->17         started        19 cmd.exe 1 11->19         started        signatures7 process8 process9 21 conhost.exe 17->21         started        23 timeout.exe 1 17->23         started        25 conhost.exe 19->25         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8d00abb9dc2e8161d63530424d10b66ad851ce075be2db66aa7e25cf1883c15f/
Threat name:
Win32.Spyware.Stealc
Create hunting rule
Status:
Malicious
First seen:
2023-05-22 02:09:08 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
24 of 36 (66.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ruakxoo4f2awdvrvgbbe2efwnlmfdtqhlprnwzvkpys46gedyfpq._file
Verdict:
malicious
Similar samples:
1d0f51c2537302f0585d483c5186b713900ac64a1dcb2a5924660d71558aa330
Stealc
23f0440bae78c2d40ebdf75a4127857fd531ea167e7525271330e966e24fa13a
Stealc
2841d614844219e1c2e937b51d5cd94f816f6b1985bf7372f0ee41c5bcb176b5
Stealc
33b834d43e55548d511dd46076c7ba48db7ffe4a50accc66bd43fa98d6793e41
Stealc
37aa7fbf692cbc7da1f9f233c37cd4e7f1a41e12d61f2c34d6bb1171863d2790
Stealc
86c349ad1aecf41f402adad10ff1c7a8e34b2f9f733db02bfd88bb1abac8128a
Stealc
f0e8c8856176b04515a8003e6830c2a371d52af0b66ebe70232a5fa1afb4a10d
Stealc
+ 1'314 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware
Link:
https://tria.ge/reports/230522-ffnyhsgh8w/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Loads dropped DLL
Downloads MZ/PE file
Unpacked files
SH256 hash:
ff2ad1c547c3dde0ad9457fc89092dae9b0aa4e8c615b70e635e00462bb3a985
MD5 hash:
0dee2523cf97b25a75c08162bf93d2de
SHA1 hash:
251c4e6b847537ef7b1bf31756e10b08509aa010
Detections:
stealc
Create hunting rule
win_stealc_auto
Create hunting rule
win_stealc_a0
Create hunting rule
Link:
https://www.unpac.me/results/d99b4a78-5384-429b-ad05-cf3fb28277c4/
SH256 hash:
8d00abb9dc2e8161d63530424d10b66ad851ce075be2db66aa7e25cf1883c15f
MD5 hash:
31bf8b85eabcf532de82e0f84b47c4c6
SHA1 hash:
c11c5d301fd6de129e8f56f36bcd541d4a185a7a
Link:
https://www.unpac.me/results/d99b4a78-5384-429b-ad05-cf3fb28277c4/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8d00abb9dc2e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8d00abb9dc2e8161d63530424d10b66ad851ce075be2db66aa7e25cf1883c15f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AppLaunch
Create hunting rule
Author:iam-py-test
Description:Detect files referencing .Net AppLaunch.exe
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:infostealer_win_stealc_standalone
Create hunting rule
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:win_stealc_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.stealc.
Rule name:win_stealc_w0
Create hunting rule
Author:crep1x
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/
Rule name:yara_template
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 8d00abb9dc2e8161d63530424d10b66ad851ce075be2db66aa7e25cf1883c15f

(this sample)

  
Delivery method
Distributed via web download

Comments