MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b32b753d94dc0a02f097626fa793432be53d5927d30abc5490a2d44a055670e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 15

Intelligence 15 IOCs YARA 10 File information Comments 1

SHA256 hash:	b32b753d94dc0a02f097626fa793432be53d5927d30abc5490a2d44a055670e5
SHA3-384 hash:	af25bf92afafd95d12b1115e2b16044d8ba70c286ba868d63a8286c03d4260dfae9b2f2845f3496c07f0e9be5abb5990
SHA1 hash:	d8484b6da5c0faf9cb0453f12d34b3c60f03fc69
MD5 hash:	678f666b1f2e04b504d62430f8e95b64
humanhash:	mockingbird-early-nebraska-jig
File name:	678f666b1f2e04b504d62430f8e95b64
Download:	download sample
Signature	Stealc Create hunting rule
File size:	10'183'264 bytes
First seen:	2024-10-28 14:14:28 UTC
Last seen:	2024-10-28 16:22:24 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	fc9ca7ac88166652cdd67ad8ff79fdb0 (1 x Stealc)
ssdeep	98304:Cq+nMiEhfX/8LyyTUspbP36igWcqmfoR5zVW:i8eDqiseRa
Threatray	4 similar samples on MalwareBazaar
TLSH	T1D6A68D52BEC4673BD0AA063EC9FB9654593FBE2C25028C1B27F4194CCE35D8C653AA17
TrID	46.7% (.EXE) Inno Setup installer (107240/4/30) 25.0% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 18.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 4.5% (.EXE) Win64 Executable (generic) (10522/11/4) 1.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
File icon (PE):
dhash icon	46deb6eae2ccf030 (1 x Stealc)
Reporter	zbetcheckin
Tags:	32 exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

396

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

678f666b1f2e04b504d62430f8e95b64

Verdict:

Malicious activity

Analysis date:

2024-10-28 14:15:52 UTC

Tags:

stealer stealc loader

Link:

https://app.any.run/tasks/a325ca23-a389-4e54-a702-9769aa3ec2cb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.FileRepMalware.30130.14874.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=671f9c6c5928ee28d55e8890

Tags:

Delphi Lien

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Connection attempt

Sending an HTTP GET request

Running batch commands

Creating a process with a hidden window

Launching a process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

embarcadero_delphi evasive fingerprint keylogger lolbin obfuscated overlay tracker

Link:

https://www.filescan.io/uploads/671f9c6a7b6de3d3d3561aa5/reports/de1fd4ab-f26a-4fb9-8d29-e130ced5849c/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b32b753d94dc0a02f097626fa793432be53d5927d30abc5490a2d44a055670e5

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9d48de01-e47b-41a3-8a4d-b84b60b648eb

Result

Threat name:

Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1543864

Signature

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

85%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b32b753d94dc0a02f097626fa793432be53d5927d30abc5490a2d44a055670e5

Detection:

azorult

Link:

https://mwdb.cert.pl/sample/b32b753d94dc0a02f097626fa793432be53d5927d30abc5490a2d44a055670e5/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wmvxkpmu3qfaf4exmjx2pe2dfpst2wjh2mflyvequlkeubkwodsq._file

Verdict:

malicious

Label(s):

stealc

Stealc

b32b753d94dc0a02f097626fa793432be53d5927d30abc5490a2d44a055670e5

Stealc

error

Stealc

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc botnet:mainteam credential_access discovery spyware stealer

Link:

https://tria.ge/reports/241028-rkj1xayngk/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

System Location Discovery: System Language Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Downloads MZ/PE file

Stealc

Stealc family

Malware Config

C2 Extraction:

http://95.182.96.50

Verdict:

Malicious

Tags:

stealc

YARA:

n/a

Link:

https://app.threat.zone/submission/408adb6d-125b-4c38-8472-db1a8fb82ca7

Unpacked files

SH256 hash:

26cb85a8c8abb8d691f0293c459ec2ca58d42cc533a9ad06af1dff8c4baa147e

MD5 hash:

0b57a8d226baa37c249437e4bbcf2465

SHA1 hash:

978fbaf382b06839a66fd1b2d58f3efb4cd32126

Detections:

stealc

win_stealc_w0

win_stealc_a0

detect_Mars_Stealer

Link:

https://www.unpac.me/results/cce93588-976c-4795-b950-78747801b6a8/

SH256 hash:

29e7e1c1e1a7e5f26f6961d8036cdd04ee4557dec0a7dcadcd8e7651f5e53f43

MD5 hash:

2ec23e83e2f63ab27c25741b1f4d7f49

SHA1 hash:

bb231b274bd66393fa830a44e6d4447d4399eeb9

Link:

https://www.unpac.me/results/cce93588-976c-4795-b950-78747801b6a8/

SH256 hash:

b32b753d94dc0a02f097626fa793432be53d5927d30abc5490a2d44a055670e5

MD5 hash:

678f666b1f2e04b504d62430f8e95b64

SHA1 hash:

d8484b6da5c0faf9cb0453f12d34b3c60f03fc69

Link:

https://www.unpac.me/results/cce93588-976c-4795-b950-78747801b6a8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b32b753d94dc0a02f097626fa793432be53d5927d30abc5490a2d44a055670e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	possible_trojan_banker Create hunting rule
Author:	@johnk3r
Description:	Detects common strings, DLL and API in Banker_BR

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe b32b753d94dc0a02f097626fa793432be53d5927d30abc5490a2d44a055670e5

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3259725/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
MULTIMEDIA_API	Can Play Multimedia	winmm.dll::sndPlaySoundW gdi32.dll::StretchDIBits
SHELL_API	Manipulates System Shell	shell32.dll::ShellExecuteW
WIN32_PROCESS_API	Can Create Process and Threads	winhttp.dll::WinHttpCloseHandle kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryA kernel32.dll::LoadLibraryExW kernel32.dll::LoadLibraryW kernel32.dll::GetDriveTypeW kernel32.dll::GetVolumeInformationW kernel32.dll::GetSystemInfo
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateDirectoryW kernel32.dll::CreateFileW kernel32.dll::CreateFileMappingW kernel32.dll::DeleteFileW kernel32.dll::GetFileAttributesW kernel32.dll::FindFirstFileW
WIN_BASE_USER_API	Retrieves Account Information	kernel32.dll::GetComputerNameW kernel32.dll::QueryDosDeviceW
WIN_HTTP_API	Uses HTTP services	winhttp.dll::WinHttpAddRequestHeaders winhttp.dll::WinHttpConnect winhttp.dll::WinHttpGetIEProxyConfigForCurrentUser winhttp.dll::WinHttpGetProxyForUrl winhttp.dll::WinHttpOpenRequest winhttp.dll::WinHttpOpen
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegConnectRegistryW advapi32.dll::RegCreateKeyExW advapi32.dll::RegDeleteKeyW advapi32.dll::RegLoadKeyW advapi32.dll::RegOpenKeyExW advapi32.dll::RegQueryInfoKeyW
WIN_USER_API	Performs GUI Actions	user32.dll::ActivateKeyboardLayout user32.dll::CreateMenu user32.dll::EmptyClipboard user32.dll::FindWindowExW user32.dll::FindWindowW user32.dll::OpenClipboard

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-10-28 14:14:29 UTC

url : hxxps://dewatabalirental.com/2.exe