MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5e7f0781b82d2f124bd113e2be8df4e6bdf61b1b25b31ad813b41336a174844. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MarsStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments 1

SHA256 hash:	a5e7f0781b82d2f124bd113e2be8df4e6bdf61b1b25b31ad813b41336a174844
SHA3-384 hash:	9c6404c70995551c0d877a626956ddf451fed399e6500182bf47eae1f9ff1770bffba4c6663d6e3f628c1af699999cb1
SHA1 hash:	500fc57fe1af43a9a13878ff08a2ce6a2969dfbc
MD5 hash:	29df412b9bddce9b6080d7fe66610868
humanhash:	kentucky-two-bakerloo-river
File name:	29df412b9bddce9b6080d7fe66610868
Download:	download sample
Signature	MarsStealer Create hunting rule
File size:	274'944 bytes
First seen:	2023-09-16 09:56:47 UTC
Last seen:	2023-09-16 11:56:28 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	be971270bdc2a8fd4ff1ab41bb993dd1 (7 x Stealc, 7 x Smoke Loader, 2 x NetSupport)
ssdeep	3072:vbkLgYBMvWahM0NbfEywI4Ds3RAM7jz9Snj7NKp3wXGwNW+f:DkL8vWahM0Nbx4DsB1j87NKp3wXGGf
Threatray	341 similar samples on MalwareBazaar
TLSH	T1EF449F03B3D1A8F1F63646318F2DCEE42AFDBD618E65665723E85B2F09B01E18972351
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0010100a23100000 (1 x MarsStealer)
Reporter	zbetcheckin
Tags:	32 exe MarsStealer

Intelligence

File Origin

# of uploads :

# of downloads :

275

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

29df412b9bddce9b6080d7fe66610868

Verdict:

Malicious activity

Analysis date:

2023-09-16 09:57:39 UTC

Tags:

stealc stealer

Link:

https://app.any.run/tasks/5947882a-989d-40ca-a4b1-ae3dc8d9b9ab

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/449011/

Detection(s):

SecuriteInfo.com.Win32.BotX-gen.22118.18999.UNOFFICIAL

Gathering data

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware lolbin packed shell32

Link:

https://www.filescan.io/uploads/65057bee0870810f017ffc42/reports/cf23429b-6fad-453f-87a3-6f574c6d0928/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/a5e7f0781b82d2f124bd113e2be8df4e6bdf61b1b25b31ad813b41336a174844

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4cd8c3f6-267e-4568-bc5f-f2f2117857cc

Result

Threat name:

Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1309413

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a5e7f0781b82d2f124bd113e2be8df4e6bdf61b1b25b31ad813b41336a174844/

Threat name:

Win32.Spyware.Stealc

Status:

Malicious

First seen:

2023-09-15 22:02:44 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 38 (68.42%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=uxt7a6a3qljpcjf5ce7cx2g7jzv56ynrwjntdlmbhnatg2qxjbca._file

Verdict:

malicious

MarsStealer

54c45269002b84d18f7c86809a608d13fe641a2a6c0e25a31b2e9fd49eac390c

MarsStealer

561d0712bfdce76c6309a6d0cf1d53686077e01980952856299ceee81f880d02

MarsStealer

7ec096310d5bb659d723caf4818b036b65d334bcdf791f6ce0c4e42c8e3ecc41

MarsStealer

96aee723f4e99b71d216411e44fa8f10a9ce7a01df947cc0c41aa8856076fa1e

MarsStealer

97362d92be5f792fe05c5d4a4ee7e702528b5591c5152a2c5b0f59da9b5dd0fb

MarsStealer

be6c808d95d56676eeb845ae082c950425a5048e99590ee3b888190e75cc8b8b

MarsStealer

dc7462bfef0b3d00d800f683b842eecc96c1839a12342f4decb0b88344297925

MarsStealer

+ 331 additional samples on MalwareBazaar

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc discovery spyware stealer

Link:

https://tria.ge/reports/230916-lyxk9shf4v/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Stealc

Malware Config

C2 Extraction:

http://charlesjones.top

Unpacked files

SH256 hash:

3b16e7380171ace72014d2c96da0f5e39e3a59b04292ae835810811c9b8993be

MD5 hash:

b680e0c51e9f88c1d01c74d5753c021d

SHA1 hash:

85c53fb73c0610cec81ce9a31c233e7cac911556

Detections:

stealc

Link:

https://www.unpac.me/results/3d168e90-de16-4ebd-9077-f4761db55585/

Parent samples :

397a029bb47f4219aae84dbc22e69c3adddb7cc1f2f139cb637c0739de17f5eb
011cbc3cf74a23b91063981091c6922a0d39303c2176139c82e184a03a16a74b
61567c014a8020eb8226d3012a13cb4f6d4121ea3ef2451bae8d70c6d6b6922a
f698d9fa8aec8b4c3ea3cddf1972726543ddb253611553dfb9cf1d49e7258926
7759724e5b391473b8db8e517f7fac502789a2c397d783ef16df0422dc9597a9
849943fd39f9cf38b39264cef4de5fbc72944efa9fe03b340ba83b7fcbf79983
c6353b3ca2cf558686e949882e30f91bf16c0b6bf845bdcb470d46293aeef0a3
d12c9f98baed5d53183af6e013e9a93468eb533f5e2709138f28006325adb573
60514c1c51b359839c67819246b09fbd861afa3ff772ad93bf466fc3acab642d
ad3b6f6c891cf7a778982d47b7003ac7073b499c5947ea7d4a6c1684fbfe05a4
910cfedbc993be6b23d3e46a0f34ee1c2a6b264f701c278d5465ec97054789d1
f18998ecadd500b197e230ebe0806bb8d3ca8d60689fb1e1f7fbe9710a4f265d
a5e7f0781b82d2f124bd113e2be8df4e6bdf61b1b25b31ad813b41336a174844
eb1574144fb3e44f9d455633d51e2e7d593c6d6d6d740d8b281707619b2dd4a1
7d81f8e1d9b0b0d61bd551eebc4a1998422663a20feb74e5e86ee8cd50679cf8

SH256 hash:

a5e7f0781b82d2f124bd113e2be8df4e6bdf61b1b25b31ad813b41336a174844

MD5 hash:

29df412b9bddce9b6080d7fe66610868

SHA1 hash:

500fc57fe1af43a9a13878ff08a2ce6a2969dfbc

Link:

https://www.unpac.me/results/3d168e90-de16-4ebd-9077-f4761db55585/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a5e7f0781b82/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a5e7f0781b82d2f124bd113e2be8df4e6bdf61b1b25b31ad813b41336a174844

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.