MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 945f5a2a5fe604802e4aadaa8ef136a11c9a0b89d1c8eff471cf2ddf355aefd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 15


Intelligence 15 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 945f5a2a5fe604802e4aadaa8ef136a11c9a0b89d1c8eff471cf2ddf355aefd4
SHA3-384 hash: 8c31c1bf6a768cb6cc54c4075b201180dc641462c4d2da965a8dcd613ba50424a7d1ad080907d02659a4c4d30b5c467a
SHA1 hash: 4f9a41e63353f568e1aa31dc9ed97e13c5804d22
MD5 hash: 685f2f3ccfb3958f91e4b8e865cd28d5
humanhash: massachusetts-minnesota-apart-blue
File name:file
Download: download sample
Signature Stealc
Create hunting rule
File size:1'831'424 bytes
First seen:2024-11-21 21:02:33 UTC
Last seen:2024-11-21 21:07:01 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:iG0Mv/7Fzc/5RqGKySgGfUx6DRLb8RydoGhjCg7IPb:iTM37VmmGdGS6NLbeydDjLkP
TLSH T1E4853371F9374C0DCD7C643362AACCA6B7A92592949FCB494816F6378ED378C3C1A960
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Bitsight
Tags:exe Stealc


Avatar
Bitsight
url: http://185.215.113.16/steam/random.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
409
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-11-21 21:04:58 UTC
Tags:
lumma stealer loader themida stealc
Link:
https://app.any.run/tasks/77821195-18c6-4c3d-96b3-357d43b22e18

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.TrojanX-gen.11170.30006.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=673fa0c4d0583382434a40e4
Tags:
vmdetect autorun spam lien
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for analyzing tools
Running batch commands
Creating a process with a hidden window
Launching a process
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm microsoft_visual_cc packed packed packer_detected
Link:
https://www.filescan.io/uploads/673fa00778e39c3f59265ebc/reports/bbf05387-2a92-42ab-bb27-23b4c1fcdc21/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/945f5a2a5fe604802e4aadaa8ef136a11c9a0b89d1c8eff471cf2ddf355aefd4
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a8605621-9512-40fd-8510-6f3a9fd12491
Result
Threat name:
Amadey, Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1560505
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Drops PE files to the document folder of the user
Drops PE files to the user root directory
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
Monitors registry run keys for changes
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Sigma detected: Potentially Suspicious Child Process Of Regsvr32
Sigma detected: Powershell launch regsvr32
Suricata IDS alerts for network traffic
Suspicious powershell command line found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Amadeys stealer DLL
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1560505 Sample: file.exe Startdate: 21/11/2024 Architecture: WINDOWS Score: 100 155 Suricata IDS alerts for network traffic 2->155 157 Found malware configuration 2->157 159 Antivirus detection for URL or domain 2->159 161 13 other signatures 2->161 14 file.exe 37 2->14         started        19 skotes.exe 2->19         started        21 skotes.exe 2->21         started        23 msedge.exe 66 629 2->23         started        process3 dnsIp4 121 185.215.113.206, 49722, 49778, 49819 WHOLESALECONNECTIONSNL Portugal 14->121 123 185.215.113.16, 49953, 80 WHOLESALECONNECTIONSNL Portugal 14->123 125 127.0.0.1 unknown unknown 14->125 99 C:\Users\user\DocumentsHCAEHJJKFC.exe, PE32 14->99 dropped 101 C:\Users\user\AppData\...\softokn3[1].dll, PE32 14->101 dropped 103 C:\Users\user\AppData\Local\...\random[1].exe, PE32 14->103 dropped 113 11 other files (none is malicious) 14->113 dropped 141 Detected unpacking (changes PE section rights) 14->141 143 Attempt to bypass Chrome Application-Bound Encryption 14->143 145 Drops PE files to the document folder of the user 14->145 153 9 other signatures 14->153 25 cmd.exe 14->25         started        27 msedge.exe 2 11 14->27         started        30 chrome.exe 14->30         started        127 185.215.113.43 WHOLESALECONNECTIONSNL Portugal 19->127 129 31.41.244.11 AEROEXPRESS-ASRU Russian Federation 19->129 105 C:\Users\user\AppData\...\76ce55fba7.exe, PE32 19->105 dropped 107 C:\Users\user\AppData\...\FunnyJellyfish.exe, PE32 19->107 dropped 109 C:\Users\user\...\FunnyJellyfish[1].exe, PE32 19->109 dropped 111 C:\Users\user\AppData\Local\...\random[1].exe, PE32 19->111 dropped 147 Hides threads from debuggers 19->147 149 Tries to detect sandboxes / dynamic malware analysis system (registry check) 19->149 151 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 19->151 33 FunnyJellyfish.exe 19->33         started        36 msedge.exe 23->36         started        38 msedge.exe 23->38         started        40 msedge.exe 23->40         started        42 msedge.exe 23->42         started        file5 signatures6 process7 dnsIp8 44 DocumentsHCAEHJJKFC.exe 25->44         started        48 conhost.exe 25->48         started        173 Monitors registry run keys for changes 27->173 50 msedge.exe 27->50         started        131 192.168.2.7, 443, 49700, 49701 unknown unknown 30->131 133 239.255.255.250 unknown Reserved 30->133 52 chrome.exe 30->52         started        81 C:\Users\user\AppData\...\FunnyJellyfish.tmp, PE32 33->81 dropped 55 FunnyJellyfish.tmp 33->55         started        135 sb.scorecardresearch.com 18.165.220.110, 443, 49837 MIT-GATEWAYSUS United States 36->135 137 104.208.16.90, 443, 49910, 49951 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 36->137 139 24 other IPs or domains 36->139 file9 signatures10 process11 dnsIp12 91 C:\Users\user\AppData\Local\...\skotes.exe, PE32 44->91 dropped 175 Multi AV Scanner detection for dropped file 44->175 177 Detected unpacking (changes PE section rights) 44->177 179 Tries to evade debugger and weak emulator (self modifying code) 44->179 181 4 other signatures 44->181 57 skotes.exe 44->57         started        115 www.google.com 142.250.181.100, 443, 49746, 49747 GOOGLEUS United States 52->115 117 plus.l.google.com 172.217.17.78, 443, 49784 GOOGLEUS United States 52->117 119 apis.google.com 52->119 93 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 55->93 dropped 95 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 55->95 dropped 60 cmd.exe 55->60         started        file13 signatures14 process15 signatures16 163 Multi AV Scanner detection for dropped file 57->163 165 Detected unpacking (changes PE section rights) 57->165 167 Tries to detect sandboxes and other dynamic analysis tools (window names) 57->167 169 4 other signatures 57->169 62 FunnyJellyfish.exe 60->62         started        65 conhost.exe 60->65         started        67 timeout.exe 60->67         started        process17 file18 97 C:\Users\user\AppData\...\FunnyJellyfish.tmp, PE32 62->97 dropped 69 FunnyJellyfish.tmp 62->69         started        process19 file20 83 C:\Users\user\AppData\Roaming\is-4PJR3.tmp, PE32+ 69->83 dropped 85 C:\Users\user\...\DelightfulCard.dll (copy), PE32+ 69->85 dropped 87 C:\Users\user\AppData\...\unins000.exe (copy), PE32 69->87 dropped 89 3 other files (2 malicious) 69->89 dropped 72 regsvr32.exe 69->72         started        process21 process22 74 regsvr32.exe 72->74         started        signatures23 171 Suspicious powershell command line found 74->171 77 powershell.exe 74->77         started        process24 process25 79 conhost.exe 77->79         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/945f5a2a5fe604802e4aadaa8ef136a11c9a0b89d1c8eff471cf2ddf355aefd4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/945f5a2a5fe604802e4aadaa8ef136a11c9a0b89d1c8eff471cf2ddf355aefd4/
Threat name:
Win32.Trojan.StealC
Create hunting rule
Status:
Malicious
First seen:
2024-11-21 21:03:13 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=srpvuks74ycialskvwvi54jwueojuc4j2heo75drz4w56nk257ka._file
Result
Malware family:
xworm
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:cryptbot family:stealc family:xworm botnet:9c9aa5 botnet:mars credential_access discovery evasion execution persistence rat spyware stealer trojan
Link:
https://tria.ge/reports/241121-z9pxfsxqhx/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Browser Information Discovery
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Windows directory
AutoIT Executable
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks BIOS information in registry
Checks computer location settings
Drops startup file
Executes dropped EXE
Identifies Wine through registry keys
Loads dropped DLL
Reads data files stored by FTP clients
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Windows security modification
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Uses browser remote debugging
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Amadey
Amadey family
CryptBot
Cryptbot family
Detect Xworm Payload
Detects CryptBot payload
Modifies Windows Defender Real-time Protection settings
Stealc
Stealc family
Xworm
Xworm family
Malware Config
C2 Extraction:
http://185.215.113.206
http://185.215.113.43
87.120.112.33:8398
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/43b8100f-6e69-4da6-bdeb-a5fa17bbeaf3
Unpacked files
SH256 hash:
ef1e9ba795b7fece06105710b12843a4b51a4855c118cf586af9a5cd2a85b2c4
MD5 hash:
477df3e65d6dc58a1a59b1abd8df0ed0
SHA1 hash:
88984135906cb694b145d8cf7ec0a30ee191a455
Detections:
win_stealc_w0
Create hunting rule
win_stealc_a0
Create hunting rule
Link:
https://www.unpac.me/results/1c576c3b-fe63-4996-b8cd-d3fc50024ddd/
SH256 hash:
945f5a2a5fe604802e4aadaa8ef136a11c9a0b89d1c8eff471cf2ddf355aefd4
MD5 hash:
685f2f3ccfb3958f91e4b8e865cd28d5
SHA1 hash:
4f9a41e63353f568e1aa31dc9ed97e13c5804d22
Link:
https://www.unpac.me/results/1c576c3b-fe63-4996-b8cd-d3fc50024ddd/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/945f5a2a5fe6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/945f5a2a5fe604802e4aadaa8ef136a11c9a0b89d1c8eff471cf2ddf355aefd4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe 945f5a2a5fe604802e4aadaa8ef136a11c9a0b89d1c8eff471cf2ddf355aefd4

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3279845/
  
URLhaus
https://urlhaus.abuse.ch/url/3079150/
  
URLhaus
https://urlhaus.abuse.ch/url/3273391/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments