MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 15

Intelligence 15 IOCs YARA 10 File information Comments 1

SHA256 hash:	a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3
SHA3-384 hash:	39edd77e193f1d3166cca76c207d5484fdfe021d78b1a044e7852c383c4532b0c35374104398a4855cc936b6e9661651
SHA1 hash:	58aaee87a639eaff32999cfe02e34063edf9b0fb
MD5 hash:	1fb40e73578701cc0fa99a9e1fd840d4
humanhash:	avocado-louisiana-moon-paris
File name:	1fb40e73578701cc0fa99a9e1fd840d4
Download:	download sample
Signature	Stealc Create hunting rule
File size:	267'264 bytes
First seen:	2024-04-26 08:25:05 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fee2e01e9ecb27c28da2b6fc37f265e9 (4 x Stealc, 1 x RedLineStealer)
ssdeep	3072:2H+3UrXqpkR7m+PvVrAGvVWbTncnMwjAwn+k/qTEW+CKbzXOXmSIN8niYhr:HT+9mzncMOAC/qT3dgzjh8nTr
TLSH	T1BA44DF1132D194B1E563867E0970BB62463EFC31DAB1C9133F9C268E5D742D0AB627AF
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	03010b0505212100 (1 x Stealc)
Reporter	zbetcheckin
Tags:	32 exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

326

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3.exe

Verdict:

Malicious activity

Analysis date:

2024-04-26 08:26:12 UTC

Tags:

stealer stealc

Link:

https://app.any.run/tasks/0fd01f29-0fea-4a11-b2ee-06f8f688874c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Connection attempt to an infection source

Sending an HTTP GET request to an infection source

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/62294cca-f0ae-4594-846e-9f9362719f31

Result

Threat name:

Mars Stealer, Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1432037

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Snort IDS alert for network traffic

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3/

Threat name:

Win32.Trojan.StealC

Status:

Malicious

First seen:

2024-04-26 08:26:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=uy34wwyqxtpx273xyqelh2a27dyan6pfa3c72r7pfdhkrwhx6hjq._file

Verdict:

malicious

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc stealer

Link:

https://tria.ge/reports/240426-kbvbyscf88/

Behaviour

Program crash

Stealc

Unpacked files

SH256 hash:

743875dcc496b10bc3b30df93f050fc7660b19a0125046769fcb5eb9166d62b9

MD5 hash:

3d508dd52445d80003ea8f82924983ed

SHA1 hash:

87573bf07f77149fd531082018f784992b183795

Detections:

stealc

win_stealc_auto

Link:

https://www.unpac.me/results/8e5593f6-9004-4b3f-9c21-3c5214aae460/

Parent samples :

1a102b793f4cad2e1bffc0a7e25ffd3601744a616d19f7f5dbd57c8a116538b3
9bef7a636bd52f5ecd74c1f4041c73eefad5e23f8a978af0201f72cd24a9b0d0
fb63921ce0bda58d6277755b5e784e7b042f646d64ebbd230a6b9b8ab3db33d7
a4805aa4e8b2cb5956f757d210eaa3cd8d14b9f882f483473b1c5cc9c64c441d
1418981255cd087e37c0995615e09d0e969a1adafc29f7995156e0b1d4c40285
6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891
d5dbffe347a31cc50559e0c91f94f47fa1f134d3678c7721685af1bdf84be133
2daf90fbe9e99b9e0378f48a8b091fa703b735760ebf32ce609b40d4648a955e
8d8e0734ba1d608ef6ee124b1d5ab196223f6eb1d50348d1eb0b6ae57cd8ad3a
4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae
0a6e0a8505b349359dc63cc92fc46f879f19f43c246eb7e2445dcaca526d70fb
4d8b8c49b376c483e08d172646b49baf697d54b815b8357008117fed39c92cb0
c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0
cb664fc08a69a03e1d7ad2d47b9d7397330601fcfd8d559149ee606d782f14ad
dadc6e78d7628c9b004c60834d4f20729bf6718b972c31ef08c3bb7181a39a7f
6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8
a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3
1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f

SH256 hash:

a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3

MD5 hash:

1fb40e73578701cc0fa99a9e1fd840d4

SHA1 hash:

58aaee87a639eaff32999cfe02e34063edf9b0fb

Link:

https://www.unpac.me/results/8e5593f6-9004-4b3f-9c21-3c5214aae460/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a637cb5b10bc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Mars_Stealer Create hunting rule
Author:	@malgamy12
Description:	detect_Mars_Stealer

Rule name:	infostealer_win_stealc_standalone Create hunting rule
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	malware_Stealc_str Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	Stealc infostealer

Rule name:	Windows_Trojan_Generic_2993e5a5 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Stealc_b8ab9ab5 Create hunting rule
Author:	Elastic Security

Rule name:	win_stealc_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.stealc.

Rule name:	win_stealc_w0 Create hunting rule
Author:	crep1x
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2810818/

URLhaus

https://urlhaus.abuse.ch/url/2754939/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetVolumeInformationW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleInputA KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleAliasesA KERNEL32.dll::GetConsoleProcessList KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateHardLinkA KERNEL32.dll::CreateFileW KERNEL32.dll::GetWindowsDirectoryA KERNEL32.dll::RemoveDirectoryA KERNEL32.dll::GetTempPathA
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-04-26 08:25:06 UTC

url : hxxp://185.172.128.127/timeSync.exe