MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 972169ef8aafaefe34cef5d4636ea82f24a8d9df9b8bd7bf8c4800be6f13b133. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments 1

SHA256 hash:	972169ef8aafaefe34cef5d4636ea82f24a8d9df9b8bd7bf8c4800be6f13b133
SHA3-384 hash:	8c78335c5a8cd9bfe80b4f019746820d21e92481ee3b0d0ce5afc56765290793a2bccd80497d8b69071961b8a65914e2
SHA1 hash:	ed98ad4cdfa3295f85f95a77b8039d76b7b55e65
MD5 hash:	e02e36dd920288bad92fcfe84bfae0c0
humanhash:	finch-fruit-west-mars
File name:	e02e36dd920288bad92fcfe84bfae0c0
Download:	download sample
Signature	Stealc Create hunting rule
File size:	313'856 bytes
First seen:	2023-12-01 03:59:47 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0bd61e688135eda02fcf13008a67a440 (6 x Smoke Loader, 2 x Stealc, 2 x Vidar)
ssdeep	3072:3TdUpBOhZ0EgosRswRzERWJc23lGXeS5Ii68paMu63jXdo:RwOhjgosqwRzERWBd+RjX
TLSH	T15D64D54382E13D46F9278B729F2F86EC771EF6508F597B6922289E1F04B11B6C1A3711
TrID	67.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 12.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.2% (.EXE) Win32 Executable (generic) (4505/5/1) 2.4% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	00002009240e1045 (1 x Stealc)
Reporter	zbetcheckin
Tags:	32 exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

333

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/461553/

Gathering data

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Gathering data

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/972169ef8aafaefe34cef5d4636ea82f24a8d9df9b8bd7bf8c4800be6f13b133

Result

Verdict:

MALICIOUS

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/72c59983-8b7a-4336-958e-f4019fe38e34

Result

Threat name:

Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1351060

Behaviour

Behavior Graph:

n/a

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/972169ef8aafaefe34cef5d4636ea82f24a8d9df9b8bd7bf8c4800be6f13b133

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/972169ef8aafaefe34cef5d4636ea82f24a8d9df9b8bd7bf8c4800be6f13b133/

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2023-12-01 04:00:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 23 (73.91%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s4qwt34kv6xp4ngo6xkgg3vif4skrwo7tof5pp4mjaal43ytwezq._file

Verdict:

malicious

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc discovery spyware stealer

Link:

https://tria.ge/reports/231201-ek3rsseg56/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Stealc

Malware Config

C2 Extraction:

http://77.91.76.36

Unpacked files

SH256 hash:

ed66a964976c558134058f86d41cbe65605d5e992b08d2c56b81ecb917848fec

MD5 hash:

c52ab967a0ef24600f25f8169e892dfd

SHA1 hash:

c75535369451fbb3edfa0ba2d8097113e74b0c63

Detections:

stealc

win_stealc_a0

win_stealc_bytecodes_oct_2023

Link:

https://www.unpac.me/results/83849253-ff71-41eb-87e1-0af9b2b3eca5/

Parent samples :

972169ef8aafaefe34cef5d4636ea82f24a8d9df9b8bd7bf8c4800be6f13b133
32ac805bc88b71ee119f23a18b3ec10c32c944f000283bdd0ffcfa26b97846bf
476a074e0c4c3afac432983406efaa29f427f2a3cffa180c5bb808865b44a74d
f648067f341eeea223fd16bb53637c6fa7ab42a808d3df6886e296b19825d66c
ba89f092b79e2be9a65d497aa9136db0ef3ba26531b30a2d20bd6ad77ae94392
3b29f950968c3e659a25e4d65085b3c2337db74cfcc88fb7172971b1c3f13837
80364d5d47fd955294cfab44b6b80469eda7c17ae3c0090b01b93f843f14b3e9

SH256 hash:

972169ef8aafaefe34cef5d4636ea82f24a8d9df9b8bd7bf8c4800be6f13b133

MD5 hash:

e02e36dd920288bad92fcfe84bfae0c0

SHA1 hash:

ed98ad4cdfa3295f85f95a77b8039d76b7b55e65

Link:

https://www.unpac.me/results/83849253-ff71-41eb-87e1-0af9b2b3eca5/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/972169ef8aaf/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/972169ef8aafaefe34cef5d4636ea82f24a8d9df9b8bd7bf8c4800be6f13b133

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.