MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c2da80a3de701401d4fd881f4983ecf110468a3edb59bdc30a7e1c5106753d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 15

Intelligence 15 IOCs YARA 7 File information Comments

SHA256 hash:	9c2da80a3de701401d4fd881f4983ecf110468a3edb59bdc30a7e1c5106753d4
SHA3-384 hash:	bbe8454dc8eb5ed592fea2e425e319634cf4eadb12a0a7560aaf81a85704954f66bf4840470f53d0898b553ef7ebf29f
SHA1 hash:	bda3fc49699d00fe00a2937399ae8c6fafc5f4c3
MD5 hash:	9e09ea9f9ca5b3fd5a39888e63d25358
humanhash:	mexico-music-september-fifteen
File name:	9c2da80a3de701401d4fd881f4983ecf110468a3edb59.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	305'152 bytes
First seen:	2023-09-15 08:00:26 UTC
Last seen:	2023-09-15 08:37:49 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	fb170d2cb5ff517fc5a6b94f9af4be2d (5 x Stealc, 1 x Smoke Loader)
ssdeep	3072:1ymOPh0mXQOjxeA2tzXBC3qCB2mbj7NRecaf7v:kmOP7XQOjAAixWA2jDa
Threatray	303 similar samples on MalwareBazaar
TLSH	T138544B03E2A1FD60D7254B32BE2ECAE86A1DF9D14E19377B12186A1F04B31B1D16367D
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0020e09094672100 (1 x Stealc)
Reporter	abuse_ch
Tags:	exe Stealc

abuse_ch

Stealc C2:
http://171.22.28.221/5c06c05b7b34e8e6.php

Intelligence

File Origin

# of uploads :

# of downloads :

294

Origin country :

Vendor Threat Intelligence

Malware family:

oski

ID:

File name:

578c111169f21fce527b0643847937dea9dc1d41035be.exe

Verdict:

Malicious activity

Analysis date:

2023-09-15 07:56:59 UTC

Tags:

gcleaner loader stealc oski stealer

Link:

https://app.any.run/tasks/924e9e85-a745-484f-9de9-84cedd87d3d5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/448791/

Detection(s):

SecuriteInfo.com.Win32.DropperX-gen.19375.14259.UNOFFICIAL

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware lolbin packed shell32

Link:

https://www.filescan.io/uploads/65040f40b572d5a2189c8ddb/reports/87256575-d24b-416d-b3b6-1b1784cbc9b2/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/9c2da80a3de701401d4fd881f4983ecf110468a3edb59bdc30a7e1c5106753d4

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Oski Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0e364adc-a0df-4e2b-80ad-08015bf2ed8e

Result

Threat name:

Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1308812

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9c2da80a3de701401d4fd881f4983ecf110468a3edb59bdc30a7e1c5106753d4/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2023-09-15 08:01:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 23 (82.61%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tqw2qcr544auahkp3ca7jgb6z4iqi2fd5w2zxxbqu7q4kedhkpka._file

Verdict:

malicious

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc discovery spyware stealer

Link:

https://tria.ge/reports/230915-jwjwaahe9x/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Stealc

Malware Config

C2 Extraction:

http://171.22.28.221

Unpacked files

SH256 hash:

2924a3879bdb3f7fb2d742fda5b37f568e00263700da8d8f10ad79e0f174637c

MD5 hash:

b4a05acf39514baaf212ed6d63e12f6c

SHA1 hash:

7488cf7f5f65811b23f8b42c907ab9a6c98ee991

Detections:

stealc

Link:

https://www.unpac.me/results/a22bba55-99de-4f12-a6a1-fffcdc33343d/

Parent samples :

8a73b841f8c01a43987ba35ed668896b4787efc87883f5fad1b510be4a96accc
891daaeaed0ec160ca3c06fd3a5a896b776bc22a7f42cb9cb02afb49b989d4ed
af80546c5f00315fe63e7ccf8814ebffc7cd58a7c59a6896e0666ba1e45bbc37
d79d2e9a5ac4b9ca988a7c4a9f89596254fb2e2ce4822a0cdcff19c512fc496e
f05d4b948c42de713d7cfd2f9d4ea06135fa3fbf768cef463aebe4bf6d32086b
9c2da80a3de701401d4fd881f4983ecf110468a3edb59bdc30a7e1c5106753d4
929ed67122bfd8c59cc050234fe294ea5cbd81044850588a57428d93c3038c8f
606d24b53caeddba0a95b703680233f07180354189e6fddd1275cf261aeede9b
ae29d62f9d34ef946a82df09a5ec21e8a0afd0306bce4b2b1ebf8dad18b2e97e
3045545357b095b5e32bf2d338ec052cf035d88ec6d2ddd06ce545eaa7eea573
be6c808d95d56676eeb845ae082c950425a5048e99590ee3b888190e75cc8b8b
35df29cb2a8b584263e5ad303a6167fc85c3c119af584cdf8ef31e76d0291eba
7ec096310d5bb659d723caf4818b036b65d334bcdf791f6ce0c4e42c8e3ecc41
2fdcf826f3200f1f19ae9468932cce1c9afb202388d9eaf57348c01bdcdccc95
2eda9334a272c1f3e49670787c60648afd3457635beae1148007b05c61e40ac8
3f92824961eb95e3a9fa8e84179e819f5894e5510a6355ed38f97c8b1a2622c8
e186ed43e1389cd0dc5b184593f490fce469594db170576cd134870e700671bc
d2fbbfffd5b5bc517a7bec449d08eaad66d462e515864b08edcb6f9014c8f364
958b35fe0c4767aa615bd25c76477875ed1891bd4ca05c8465a1602ee55283a9
bc7bc2e78ad0bbb1be1f4c60f7cc6f2ed639c9d1f6a9a42f6f1497e6a083708b
eca8f5d25f650cab4032c7aec6c629efa5cf886ff41130acec5cc4c29446a478
4c05ab8d8ad1fc8528b9faab9f3bf2038c4ecd90c831dcbc724af4fe60086aea
f36497550dfecfee3505c7176924a1afe8b49b628e2bca2441e6e0ffcb2b7899
596461203897b81f323698f038b2cb5a124e246e9b514fdded546efc9e336882

SH256 hash:

9c2da80a3de701401d4fd881f4983ecf110468a3edb59bdc30a7e1c5106753d4

MD5 hash:

9e09ea9f9ca5b3fd5a39888e63d25358

SHA1 hash:

bda3fc49699d00fe00a2937399ae8c6fafc5f4c3

Link:

https://www.unpac.me/results/a22bba55-99de-4f12-a6a1-fffcdc33343d/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9c2da80a3de7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9c2da80a3de701401d4fd881f4983ecf110468a3edb59bdc30a7e1c5106753d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Mars_Stealer Create hunting rule
Author:	@malgamy12
Description:	detect_Mars_Stealer

Rule name:	infostealer_win_stealc_standalone Create hunting rule
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	win_stealc_w0 Create hunting rule
Author:	crep1x
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/