MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa80ab3d660d0340897cc55f6a342cdfba3b67c2d7335315a371f7bd17cdd3fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa80ab3d660d0340897cc55f6a342cdfba3b67c2d7335315a371f7bd17cdd3fe
SHA3-384 hash: 3f6e11e06e914c08b190cef4a59ac406ed8827fb7c9677db0d132498e2557e2bdc063cef8cf712d5a95c5e7f7e8befb8
SHA1 hash: 1cbd175401727824fda2640da9378283daa1fb74
MD5 hash: 5d42f1bc7d897b1af4f32d8e7ab630c7
humanhash: mountain-seven-massachusetts-kansas
File name:file
Download: download sample
Signature Stealc
Create hunting rule
File size:518'800 bytes
First seen:2023-05-21 00:58:57 UTC
Last seen:2023-05-21 01:40:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:4qUvP5KD8bfn7RdtT/j9AL2sw/jAhNVmFOnlBePrz2F:4zs8fnx/RAL2sIAhbmFOlgX2F
Threatray 1'436 similar samples on MalwareBazaar
TLSH T124B4D065762A1623E21A2FFDB49A3B719750BC3D7DFA860510B7AB02060D548CE27CDF
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon ccbcecc4d4e4e870 (1 x Stealc)
Reporter andretavare5
Tags:exe signed Stealc

Code Signing Certificate

Organisation:LG Glade Wide 27WP500-Black
Issuer:LG Glade Wide 27WP500-Black
Algorithm:sha1WithRSAEncryption
Valid from:2023-05-19T12:24:35Z
Valid to:2033-05-20T12:24:35Z
Serial number: 71eb3519476dceaa4eba4ce05d34d0fb
Thumbprint Algorithm:SHA256
Thumbprint: 83747b4d14950a0e5d35cb430337eebd3972756f9b97ebce703a41aa8fcaca7b
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from https://vk.com/doc797927207_660696390?hash=x3zH6CTu3DZybZZbgCyXl1oFs2fSzPQAHxqjAGDdsY8&dl=LtsB7RQJDZbf2ldnxdD1oifwn57bXxJqgBHCWuDtg4T&api=1&no_preview=1#birge5

Intelligence

File Origin
# of uploads :
2
# of downloads :
256
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-05-21 00:59:41 UTC
Tags:
stealc trojan stealer loader
Link:
https://app.any.run/tasks/75c77adc-0c94-4958-b672-0d6c89ecc4ea

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win64.PWSX-gen.14781.20477.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Launching a process
Creating a file
Сreating synchronization primitives
Sending an HTTP GET request
Reading critical registry keys
Changing a file
Creating a window
Running batch commands
Creating a process with a hidden window
Searching for the window
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/64696cd64280adb5d9108914/reports/4c4bd18c-2502-4ae4-a5fb-9700686e9821/overview
Verdict:
Malicious
Labled as:
MSIL/Kryptik_AGeneric.ATI trojan
Link:
https://www.hybrid-analysis.com/sample/aa80ab3d660d0340897cc55f6a342cdfba3b67c2d7335315a371f7bd17cdd3fe
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/500f50cf-1c7e-40ae-8137-b93821dc2779
Result
Threat name:
Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1238381
Signature
C2 URLs / IPs found in malware configuration
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 871376 Sample: file.exe Startdate: 21/05/2023 Architecture: WINDOWS Score: 100 39 Snort IDS alert for network traffic 2->39 41 Found malware configuration 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 4 other signatures 2->45 8 file.exe 4 2->8         started        process3 file4 29 C:\Users\user\AppData\Local\...\file.exe.log, ASCII 8->29 dropped 47 Writes to foreign memory regions 8->47 49 Injects a PE file into a foreign processes 8->49 12 jsc.exe 49 8->12         started        17 conhost.exe 8->17         started        19 SMSvcHost.exe 8->19         started        21 7 other processes 8->21 signatures5 process6 dnsIp7 37 91.107.224.54, 49697, 80 HETZNER-ASDE Germany 12->37 31 C:\Users\user\Desktop\TQDFJHPUIU.xlsx, ASCII 12->31 dropped 33 C:\Users\user\Desktop33WCXBPIUYI.docx, ASCII 12->33 dropped 35 C:\Users\user\DesktopbehaviorgraphIGIYTFFYT.xlsx, ASCII 12->35 dropped 51 Tries to harvest and steal browser information (history, passwords, etc) 12->51 53 Found evasive API chain (may stop execution after checking locale) 12->53 55 Tries to steal Crypto Currency Wallets 12->55 57 Modifies existing user documents (likely ransomware behavior) 12->57 23 cmd.exe 1 12->23         started        file8 signatures9 process10 process11 25 conhost.exe 23->25         started        27 timeout.exe 1 23->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa80ab3d660d0340897cc55f6a342cdfba3b67c2d7335315a371f7bd17cdd3fe/
Threat name:
Win64.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2023-05-21 00:59:05 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
3
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vkakwplgbububcl4yvpwunbm365dwz6c24zvgfndoh332f6n2p7a._file
Verdict:
malicious
Similar samples:
41955ff332c22ffa3c2014f4bdffc2db6b5ae75d8289df443929a507dca525cd
Stealc
4fe523babbfae3a14393d7b07afbbfc13be4f5084dba9588adb38913b3527c36
Stealc
66bdde9f427859cc6b7cc1ff67bdf9d93ff8b0d7bc226185cb2195c746e28a0a
Stealc
67ffb10d7ef8cc9b49ef3ad7affcd7f865391cac2cdbad7ae1d259ec6a4a0cb8
Stealc
bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268
Stealc
bbea7541f726c2ecb8eebbc87f6f52b50db57a836571ae9b0f1fd91dfb653b48
Stealc
bc8560177aa43a687207e68c27c1c9378eb6fff83e61d279641c9256d79ea055
Stealc
cb8cd78c09c1a9dd7b2cf6a4288c984b4b5619ab8301d1a963e089024bb314d0
Stealc
e2dbdd45e11e2b7e32caef9e2f4365d05e63eaf13724bea2ed842a503adb802f
Stealc
+ 1'426 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230521-bb3hwsfd95/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
Unpacked files
SH256 hash:
aa80ab3d660d0340897cc55f6a342cdfba3b67c2d7335315a371f7bd17cdd3fe
MD5 hash:
5d42f1bc7d897b1af4f32d8e7ab630c7
SHA1 hash:
1cbd175401727824fda2640da9378283daa1fb74
Link:
https://www.unpac.me/results/9afe652f-9e87-4d6f-9c6f-d311cded4d99/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/aa80ab3d660d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa80ab3d660d0340897cc55f6a342cdfba3b67c2d7335315a371f7bd17cdd3fe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by

Comments