MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9643edaedb1e0b2075c9d608e12477727015706f3fe670283d84fb7dae49c88d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 12

Intelligence 12 IOCs YARA 15 File information Comments

SHA256 hash:	9643edaedb1e0b2075c9d608e12477727015706f3fe670283d84fb7dae49c88d
SHA3-384 hash:	dac5eccc83f88bc26fcba55a59bf7dfedac52eacad5fe37e19c71fc64b1d0c732de12cd029cde89668f93df908fe8843
SHA1 hash:	52f236653ea65a1af0787d4156367f599b5e2eb6
MD5 hash:	d6f3ceb0ebf498e67d40d3191e42d9e7
humanhash:	leopard-ohio-xray-nitrogen
File name:	d6f3ceb0ebf498e67d40d3191e42d9e7.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	286'720 bytes
First seen:	2024-03-01 09:00:17 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	19db24bf6bd95b0b62d115251f15fae8 (1 x Stealc)
ssdeep	3072:UkjzEcPyUPCOr9Zu6i8gms4cXqQ3n/Uc9UMAX5+I59TddGdJrTnnV:vMUPCOj7ktqMP08EvKJrT
TLSH	T1C2549E1362A2B861D52B46718D2EC6F83A6EB4F16F54677723297BEF8C701B1C223711
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.1% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	0105112b0a492900 (1 x Stealc)
Reporter	abuse_ch
Tags:	exe Stealc

abuse_ch

Stealc C2:
http://185.172.128.145/3cd2b41cbde8fc9c.php

Intelligence

File Origin

# of uploads :

# of downloads :

450

Origin country :

Vendor Threat Intelligence

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Gathering data

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/9643edaedb1e0b2075c9d608e12477727015706f3fe670283d84fb7dae49c88d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6ac4c38b-9a5e-4699-9ea6-aa8a89e782e3

Result

Threat name:

Mars Stealer, Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1401296

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Searches for specific processes (likely to inject)

Snort IDS alert for network traffic

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9643edaedb1e0b2075c9d608e12477727015706f3fe670283d84fb7dae49c88d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9643edaedb1e0b2075c9d608e12477727015706f3fe670283d84fb7dae49c88d/

Threat name:

Win32.Trojan.StealC

Status:

Malicious

First seen:

2024-03-01 09:01:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=szb63lw3dyfsa5oj2yeocjdxojybk4dph7thakb5qt5x3lsjzcgq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/240301-kyv7rseg5t/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Unpacked files

SH256 hash:

34fe69a9b647c5bf5c6ad6c5b23428df602fe0a371fdcca877bbe0c13f853fb7

MD5 hash:

aa4337e27c4f46938e24465535ba1b63

SHA1 hash:

6f6408a304bdd5e143fb8869f82ace9b7099a36a

Detections:

win_stealc_auto

Link:

https://www.unpac.me/results/4c32bb1c-114c-4502-93c4-ed4c4891b25c/

Parent samples :

a863912b539cb57887b41e05ac11e17298bac7565c6c715b33fe287590848d5d
9643edaedb1e0b2075c9d608e12477727015706f3fe670283d84fb7dae49c88d

SH256 hash:

9643edaedb1e0b2075c9d608e12477727015706f3fe670283d84fb7dae49c88d

MD5 hash:

d6f3ceb0ebf498e67d40d3191e42d9e7

SHA1 hash:

52f236653ea65a1af0787d4156367f599b5e2eb6

Link:

https://www.unpac.me/results/4c32bb1c-114c-4502-93c4-ed4c4891b25c/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9643edaedb1e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9643edaedb1e0b2075c9d608e12477727015706f3fe670283d84fb7dae49c88d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Mars_Stealer Create hunting rule
Author:	@malgamy12
Description:	detect_Mars_Stealer

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of MFA browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	malware_Stealc_str Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	Stealc infostealer

Rule name:	QbotStuff Create hunting rule
Author:	anonymous

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	win_stealc_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.stealc.

Rule name:	yara_template Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe 9643edaedb1e0b2075c9d608e12477727015706f3fe670283d84fb7dae49c88d

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2749139/

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2755131/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
MULTIMEDIA_API	Can Play Multimedia	GDI32.dll::StretchDIBits
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::FindNextVolumeMountPointA KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetVolumeInformationA KERNEL32.dll::GetStartupInfoA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::AddConsoleAliasA KERNEL32.dll::WriteConsoleA KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::ReadConsoleA KERNEL32.dll::ReadConsoleInputW
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryExA KERNEL32.dll::CreateFileA KERNEL32.dll::RemoveDirectoryW KERNEL32.dll::GetTempFileNameA
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegSetValueA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample