🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b195ea31c7c6d9b1976653fd2061f0c63f2bcec729a80ea87f5aa6f3256f3d88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b195ea31c7c6d9b1976653fd2061f0c63f2bcec729a80ea87f5aa6f3256f3d88
SHA3-384 hash: 18d60b7f4c18c986ba861a39e0b46374f05622364cdf777e99ca23f45b6c6115193df5c9f0f86e7ffa672c7536bfba84
SHA1 hash: 0a319fccf955656b27c357269a52f19477791c44
MD5 hash: 91b127719eb073898fc38500440d9d17
humanhash: music-cola-edward-mobile
File name:b195ea31c7c6d9b1976653fd2061f0c63f2bcec729a80ea87f5aa6f3256f3d88
Download: download sample
Signature Stealc
Create hunting rule
File size:196'608 bytes
First seen:2025-09-12 15:48:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:rE6ZgWlv2qBO5cUoDSXkrfGAtYJLoZWx/naKPKYjHR2Th:VqW9hUGpYJLb4Th
TLSH T123142B1F6BE503F4C09B82B4CA57E492F67DB00A1370E45F07E518B5AF6A561ACDEB10
TrID 25.4% (.ICL) Windows Icons Library (generic) (2059/9)
25.0% (.EXE) OS/2 Executable (generic) (2029/13)
24.7% (.EXE) Generic Win/DOS Executable (2002/3)
24.7% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter mazznrz
Tags:exe Stealc

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
ID ID
Vendor Threat Intelligence
Detection:
Stealc
Create hunting rule
Link:
https://www.capesandbox.com/analysis/27209/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68c440dfd49ea3f1e4b4b1aa
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
microsoft_visual_cc overlay packed zero
Link:
https://www.filescan.io/uploads/68c441357328794829283fa3/reports/cad31d0e-bf77-4cb2-91f3-d5afc05fb0ca/overview
Verdict:
Malicious
Labled as:
Trojan[PSW]/Stealer
Link:
https://www.hybrid-analysis.com/sample/b195ea31c7c6d9b1976653fd2061f0c63f2bcec729a80ea87f5aa6f3256f3d88
Verdict:
Unknown
File Type:
exe x64
Link:
https://opentip.kaspersky.com/b195ea31c7c6d9b1976653fd2061f0c63f2bcec729a80ea87f5aa6f3256f3d88/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/ada602df-8338-41e3-8e7c-62c7a41b536e
Score:
43%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/b195ea31c7c6d9b1976653fd2061f0c63f2bcec729a80ea87f5aa6f3256f3d88
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE Memory-Mapped (Dump)
Link:
https://app.malva.re/file/91b127719eb073898fc38500440d9d17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b195ea31c7c6d9b1976653fd2061f0c63f2bcec729a80ea87f5aa6f3256f3d88/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wgk6umohy3m3df3gkp6saypqyy7sxtwhfgua5kd7lktpgjlphwea._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250912-s9r89awlx2/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/b904c129-c3fb-43a4-a26e-4d57e77a358e
Unpacked files
SH256 hash:
b195ea31c7c6d9b1976653fd2061f0c63f2bcec729a80ea87f5aa6f3256f3d88
MD5 hash:
91b127719eb073898fc38500440d9d17
SHA1 hash:
0a319fccf955656b27c357269a52f19477791c44
Link:
https://www.unpac.me/results/3c576d90-5ea7-4173-a398-5ff7dd114db9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/b195ea31c7c6d9b1976653fd2061f0c63f2bcec729a80ea87f5aa6f3256f3d88

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:StealcV2
Create hunting rule
Author:Still
Description:attempts to match the instructions found in StealcV2
Rule name:StealcV2
Create hunting rule
Author:kevoreilly
Description:Stealc V2 Payload
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/27209/

Comments