MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 17

Intelligence 17 IOCs YARA 23 File information Comments

SHA256 hash:	a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06
SHA3-384 hash:	5a517ad70747501c8a4bbedbc41efd04dd4de336a7e085303ffe61890657b93968523201519d542265a3cfbc69af998c
SHA1 hash:	e8e1b890692083e893de4c8eec718200ce00ca14
MD5 hash:	75914207c89e01520ec7905774192f04
humanhash:	kitten-magazine-blue-muppet
File name:	SecuriteInfo.com.Trojan.DownLoader49.25798.1231.24170
Download:	download sample
Signature	Stealc Create hunting rule
File size:	2'293'248 bytes
First seen:	2026-01-07 17:22:52 UTC
Last seen:	2026-01-17 01:06:02 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f0ea7b7844bbc5bfa9bb32efdcea957c (151 x Vidar, 68 x Sliver, 35 x RemusStealer)
ssdeep	49152:ZaBNlIwxb3uCrb/TMvO90d7HjmAFd4A64nsfJt0udLClUBr4HyfZhsRoYg15Q6Eb:ut3unArwYh
Threatray	218 similar samples on MalwareBazaar
TLSH	T113B56B47BC9015B9C4AED2318A6A92527A70BC990F3163DB3A60B3FC2F727D45E75318
TrID	48.7% (.EXE) Win64 Executable (generic) (10522/11/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
dhash icon	4cd4e6e0b9b09244 (1 x OffLoader, 1 x Stealc)
Reporter	SecuriteInfoCom
Tags:	exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

135

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

amadey

ID:

File name:

https://www.mediafire.com/file/5lit048a1f74tjc/Simple+Checker.zip/file

Verdict:

Malicious activity

Analysis date:

2026-01-04 20:13:52 UTC

Tags:

stealer stealc amadey botnet python loader arch-doc telegram windivert-sys mal-driver rdp auto generic svcstealer xor-url

Link:

https://app.any.run/tasks/5265b250-4ce5-46a1-915c-3ef4d48eea71

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Stealc

Link:

https://www.capesandbox.com/analysis/48089/

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=695e44689922425f92fe3eda

Tags:

dropper small hype

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Сreating synchronization primitives

Sending an HTTP POST request to an infection source

Sending a custom TCP request

Connection attempt to an infection source

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-01-04T18:22:00Z UTC

Last seen:

2026-01-07T17:10:00Z UTC

Hits:

~100

Detections:

VHO:Trojan-PSW.Win32.Lumma.gen Trojan-PSW.Win64.StealC.sb Trojan-PSW.Lumma.HTTP.C&C Trojan-PSW.Win32.Lumma.zvr Trojan.Win32.Inject.sb

Link:

https://opentip.kaspersky.com/a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/daf8161b-53f1-4d14-a3c6-e327052014c4

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/75914207c89e01520ec7905774192f04

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06/

Verdict:

Malicious

Threat:

Family.STEALC

Link:

https://tip.neiki.dev/file/a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06

Threat name:

Win64.Spyware.Stealc

Status:

Suspicious

First seen:

2026-01-04 20:43:55 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

21 of 36 (58.33%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=uvelmv4demo4fvfjg2wazxphvy3tvscocfbkoz4l2bc3tujjzqda._file

Verdict:

malicious

Label(s):

stealc

Stealc

65170a027c2050be22fc06e635694d410f2a4afe0c38bf3787d283a564f9ef95

Stealc

8f9e7b559aa9c2aedc0453bde8ac2eb966d00e43fd9fbdbfe50fba5591020887

Stealc

a3a0322ac654a42a0883f23b01e19a6dd6586b099d124d9421e1c81de1317cc7

Stealc

c92d3b7961692f031863195786b6dbd7daff071635fc4622be6d50d6970ac531

Stealc

cef044e0065c13da7b0d6c4b4d985dd4c24d86893d4f0084f1d844972cfd3927

Stealc

+ 208 additional samples on MalwareBazaar

Result

Malware family:

svcstealer

Score:

10/10

Tags:

family:stealc family:svcstealer botnet:crypt discovery downloader installer persistence spyware stealer upx

Link:

https://tria.ge/reports/260107-vx83cady7d/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Inno Setup is an open-source installation builder for Windows applications.

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in System32 directory

Suspicious use of SetThreadContext

UPX packed file

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Detects SvcStealer Payload

Stealc

Stealc family

SvcStealer, Diamotrix

Svcstealer family

Malware Config

C2 Extraction:

http://196.251.107.23

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/60358375-0bee-4c9e-844b-f59c3140f721

Unpacked files

SH256 hash:

a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06

MD5 hash:

75914207c89e01520ec7905774192f04

SHA1 hash:

e8e1b890692083e893de4c8eec718200ce00ca14

Link:

https://www.unpac.me/results/bac05607-ba4c-46bc-b9e8-376c3f245610/

Malware family:

Stealc.v2

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a548b6578323/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.72

Link:

https://yomi.yoroi.company/submissions/a548b65783231dc2d4a936ac0cdde7ae373ac84e1142a7678bd045b9d129cc06

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	Golangmalware Create hunting rule
Author:	Dhanunjaya
Description:	Malware in Golang

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	golang_duffcopy_amd64 Create hunting rule

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	HiveRansomware Create hunting rule
Author:	Dhanunjaya
Description:	Yara Rule To Detect Hive V4 Ransomware

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)