MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2aa1408b77d5272d0e9f7250e196124fd2cc5d86f8ef90abe0ec37ea27b41af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 15

Intelligence 15 IOCs YARA 6 File information Comments

SHA256 hash:	b2aa1408b77d5272d0e9f7250e196124fd2cc5d86f8ef90abe0ec37ea27b41af
SHA3-384 hash:	a46642ac030d7bd9cea483915a7efe5e8f25f00019fa894d4c2c2c9f0950b11fab73d199c6a8830f6838d4ebdc393d7f
SHA1 hash:	3a9fbc8d91356e610f02ef5998df998f972a70db
MD5 hash:	07e1135280b0856cbf74d013e5aed90e
humanhash:	video-river-thirteen-edward
File name:	file
Download:	download sample
Signature	Stealc Create hunting rule
File size:	315'392 bytes
First seen:	2023-09-26 14:06:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3a2cfd451f63c964ba41b70cb789f61b (1 x Stealc, 1 x TeamBot, 1 x RedLineStealer)
ssdeep	3072:SDdLb8Lyom0PXxdwglElsoFBq7JvlbCKQw0G9jSa3p10IUxwVapbOU:6Lb8LdmkhdwgKPiVvJQw0GlSI2tpK
Threatray	1 similar samples on MalwareBazaar
TLSH	T1E4646C1393E17C61E5364B3E9E2EC2EC765EF5504E6A776A32189A2B04B01F3D273711
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	08cce0e054665240 (1 x Stealc)
Reporter	andretavare5
Tags:	exe Stealc

andretavare5

Sample downloaded from http://christopherantonio.top/calc2.exe

Intelligence

File Origin

# of uploads :

# of downloads :

290

Origin country :

Vendor Threat Intelligence

Malware family:

oski

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2023-09-26 14:09:10 UTC

Tags:

oski stealc

Link:

https://app.any.run/tasks/c5283494-9c1f-49f9-b22f-cdc58e1653b7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/451307/

Detection(s):

SecuriteInfo.com.Win32.DropperX-gen.2793.22502.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/6512e588988a26b6d971005d/reports/dba3ba8f-9dec-469a-8311-a364b9a36a08/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/b2aa1408b77d5272d0e9f7250e196124fd2cc5d86f8ef90abe0ec37ea27b41af

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Oski Stealer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0da28a4c-e200-44a1-ae0a-f9aa61ea58bb

Result

Threat name:

Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1314601

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b2aa1408b77d5272d0e9f7250e196124fd2cc5d86f8ef90abe0ec37ea27b41af/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2023-09-26 14:07:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 23 (86.96%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=wkvbicfxpvjhfuhj64sq4glbet6szroyn6hpscv6b3bx5it3igxq._file

Verdict:

malicious

Stealc

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc discovery spyware stealer

Link:

https://tria.ge/reports/230926-rezjeabc53/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Stealc

Malware Config

C2 Extraction:

http://bryanzachary.top

Unpacked files

SH256 hash:

fe6edbc42a1b391d80eac4c06b5dd169cebbc353f67a6e1d780770be829ce27e

MD5 hash:

7b1a0ddf9afe48ddd7a79a9c3964f353

SHA1 hash:

db3922ddda9702a979090b50cd640521ce0eed99

Detections:

stealc

Link:

https://www.unpac.me/results/cc3023dd-f2bc-443d-b383-9859a0bcd3f0/

Parent samples :

926bb9311b6d628c34e16f770695418656be7158d16b412c5954faa74ff57fbe
b2aa1408b77d5272d0e9f7250e196124fd2cc5d86f8ef90abe0ec37ea27b41af
774a5633a5cf948de71702480044e7466daaaea595d4149c2414cb995b7c3378
09d0c1b8d3b4e342f35326bc754e7a05ac3b31fed0c60a86477a4336554059f4
576ae20ecf51decbf1e8a5a934975b451f8a11e03766928535a49e70c368175b

SH256 hash:

b2aa1408b77d5272d0e9f7250e196124fd2cc5d86f8ef90abe0ec37ea27b41af

MD5 hash:

07e1135280b0856cbf74d013e5aed90e

SHA1 hash:

3a9fbc8d91356e610f02ef5998df998f972a70db

Link:

https://www.unpac.me/results/cc3023dd-f2bc-443d-b383-9859a0bcd3f0/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b2aa1408b77d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b2aa1408b77d5272d0e9f7250e196124fd2cc5d86f8ef90abe0ec37ea27b41af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_Mars_Stealer Create hunting rule
Author:	@malgamy12
Description:	detect_Mars_Stealer

Rule name:	infostealer_win_stealc_standalone Create hunting rule
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

Rule name:	win_stealc_w0 Create hunting rule
Author:	crep1x
Description:	Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:	https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/