MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbc7dd5d471b06ed6e6f3ee03bef18e6967cf244bbc1ede6af795de22aaad6a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bbc7dd5d471b06ed6e6f3ee03bef18e6967cf244bbc1ede6af795de22aaad6a9
SHA3-384 hash:	cdf74a5bc62ef341f2148c6b30640c8e3e723e4e20594e4287fa70dae34e8ff0285fa8de1528e414c7064c435af2eca0
SHA1 hash:	8cf8bfdfb417eefbc757d69786d7bd12c9f16ee0
MD5 hash:	a73814e6836505e8df40a9d256364772
humanhash:	football-william-crazy-music
File name:	a73814e6836505e8df40a9d256364772.exe
Download:	download sample
Signature	Stealc Alert Create hunting rule
File size:	314'368 bytes
First seen:	2023-12-24 08:20:33 UTC
Last seen:	2023-12-24 10:14:10 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	2217a8c5b0dd2408ef1805b58b7c86d5 (4 x Smoke Loader, 2 x Amadey, 1 x Stealc)
ssdeep	6144:EtbnZdLcg2FBzACwdQdhlxRzZUFPHeZNi2fKVtV:cbnL4n1ACwilkBeJfKPV
TLSH	T197648C2132E0D031E6E719F58A74CBB90E7B78726825958FBBD05AB93E207D1DB1530E
TrID	46.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 25.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 8.5% (.EXE) Win64 Executable (generic) (10523/12/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):
dhash icon	9370c4d2ccf031da (1 x Stealc)
Reporter	abuse_ch
Tags:	exe Stealc

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

292

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/469184/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Siggen22.50451.22520.32655.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Reading critical registry keys

Changing a file

Creating a file in the %AppData% subdirectories

Creating a window

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Stealing user critical data

Sending an HTTP GET request to an infection source

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6587e9f1ffafd83ebc999eb4/reports/138a3f16-4b84-4d97-81ff-affad93cc22f/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/bbc7dd5d471b06ed6e6f3ee03bef18e6967cf244bbc1ede6af795de22aaad6a9

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Stealc

Malware family:

Stealc

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b2906ff3-7513-48d3-83d4-5b0d06f6c5bf

Joe Sandbox Stealc, Vidar

Result

Threat name:

Stealc, Vidar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1366650

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/bbc7dd5d471b06ed6e6f3ee03bef18e6967cf244bbc1ede6af795de22aaad6a9

CERT.PL MWDB stealc

Detection:

stealc

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/bbc7dd5d471b06ed6e6f3ee03bef18e6967cf244bbc1ede6af795de22aaad6a9/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xpd52xkhdmdo23tph3qdx3yy42lhz4sexpa63zvppfo6ekvk22uq._file

Threatray malicious

Verdict:

malicious

Hatching Triage stealc

Result

Malware family:

stealc

Alert

Create hunting rule

Score:

  10/10

Tags:

family:stealc discovery spyware stealer

Link:

https://tria.ge/reports/231224-j81dssbdfr/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Stealc

Malware Config

C2 Extraction:

http://77.91.76.36

UnpacMe stealc win_stealc_auto win_stealc_a0 win_stealc_bytecodes_oct_2023

Unpacked files

SH256 hash:

7fdbfde21e6a9f34966dcbf2c4f008f7c13a52385852aad40e0485c23ec6b614

MD5 hash:

fadec2f496629ad87cfbb9a2a7f5446d

SHA1 hash:

da783e5c9568589655760aea863def2b5df5342a

Detections:

stealc

Alert

Create hunting rule

win_stealc_auto

Alert

Create hunting rule

win_stealc_a0

Alert

Create hunting rule

win_stealc_bytecodes_oct_2023

Alert

Create hunting rule

Link:

https://www.unpac.me/results/26742be7-6f0c-47ba-b09e-e37d75967d4d/

Parent samples :

e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683
7eda35b2c10d5bbc286d3f446c142758783aea0535b55c9dd42968d35ca202fa
fa6ba41bff46096cf24102217650b7a3190a5b7ae13f0c69c96bb38f726014f5
81628e4300b6cebde33d6cfbee5f483d230216616b812e6896aa159d77b0c081
bbc7dd5d471b06ed6e6f3ee03bef18e6967cf244bbc1ede6af795de22aaad6a9

SH256 hash:

bbc7dd5d471b06ed6e6f3ee03bef18e6967cf244bbc1ede6af795de22aaad6a9

MD5 hash:

a73814e6836505e8df40a9d256364772

SHA1 hash:

8cf8bfdfb417eefbc757d69786d7bd12c9f16ee0

Link:

https://www.unpac.me/results/26742be7-6f0c-47ba-b09e-e37d75967d4d/

VMRay Stealc

Malware family:

Stealc

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bbc7dd5d471b/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bbc7dd5d471b06ed6e6f3ee03bef18e6967cf244bbc1ede6af795de22aaad6a9

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe bbc7dd5d471b06ed6e6f3ee03bef18e6967cf244bbc1ede6af795de22aaad6a9

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2736472/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/469184/