MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 92a8cc4e385f170db300de8d423686eeeec72a32475a9356d967bee9e3453138. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Stealc
Vendor detections: 12
| SHA256 hash: | 92a8cc4e385f170db300de8d423686eeeec72a32475a9356d967bee9e3453138 |
|---|---|
| SHA3-384 hash: | e728a7cf4a3e4e04e99fc438a8ebcd7aae41cba07f797c1a8b1ee29f47acab81940f89c987cb73f361740631cf0f8d1c |
| SHA1 hash: | fe28d5756815fdac31a744a2f11c075f5b1892bc |
| MD5 hash: | acfba6ff2e80e0ebc80df9e7d326337c |
| humanhash: | sierra-yankee-utah-fish |
| File name: | fix-error |
| Download: | download sample |
| Signature | Stealc |
| File size: | 76'593 bytes |
| First seen: | 2024-10-17 08:35:58 UTC |
| Last seen: | Never |
| File type: |  vbs |
| MIME type: | text/html |
| ssdeep | 768:BfaGWSO85ALmEcHUfkJ7Bate4LV1VZ6Y3PaNNHpXKMcpgUj:gGZALNcH77BajLbf61NR1pcbj |
| Threatray | 161 similar samples on MalwareBazaar |
| TLSH | T16F73DC871E28EDD0338F6979BEAC619012D0DB6F6FB391A1D04BC5B12F219A975047B3 |
| Magika | vba |
| Reporter |  crep1x |
| Tags: | Stealc vbs |
Intelligence
File Origin
# of uploads :
1
# of downloads :
101
Origin country :
FRVendor Threat Intelligence
Detection(s):
Verdict:
Malicious
Score:
93.3%
Tags:
Malware
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Verdict:
Malicious
Labled as:
VBS.DOWNloader.G.Generic
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Threat name:
Script-WScript.Trojan.Stealc
Status:
Suspicious
First seen:
2024-09-25 17:43:56 UTC
File Type:
Text (HTML)
Extracted files:
1
AV detection:
15 of 38 (39.47%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
stealc
Similar samples:
+ 151 additional samples on MalwareBazaar
Result
Malware family:
stealc
Score:
10/10
Tags:
family:hijackloader family:stealc botnet:sneprivate29 brand:google discovery dropper loader phishing stealer
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies Internet Explorer settings
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Detected potential entity reuse from brand GOOGLE.
Suspicious use of SetThreadContext
Blocklisted process makes network request
Download via BitsAdmin
Downloads MZ/PE file
Detects HijackLoader (aka IDAT Loader)
HijackLoader
Stealc
Malware Config
C2 Extraction:
http://95.182.97.58
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Distributed via drive-by
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.