MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc182c1ad875034766bf6f30db48ccd680a19757d51c21624d40c29f8609eb9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Tosee

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	bc182c1ad875034766bf6f30db48ccd680a19757d51c21624d40c29f8609eb9f
SHA3-384 hash:	b52f7038ff0e84d5f231e3e0d304768a014c6abe1beaea57c7dbe2d860ccdf717a1c75eda89fbd572a17539438f5d63f
SHA1 hash:	b0bacd5f4a7de6f19c00ec0f4835f6bb48bcb7f4
MD5 hash:	1745b614ef0599b757d8b96daa503bc1
humanhash:	lithium-avocado-johnny-papa
File name:	file
Download:	download sample
Signature	Tosee Create hunting rule
File size:	263'168 bytes
First seen:	2023-11-19 11:22:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	75f7b043db8054e118136d70892dffd3 (3 x Tosee, 1 x Stealc, 1 x Smoke Loader)
ssdeep	3072:7fswbZleldn2I8vQhQrX+98nXPTw7roCbSM4UB1j3fPJ9oc9RiHMa7ovbDh9w:T/leznc4sO98nKroCWG5nro1s6M4
TLSH	T18444AEE329E0BC7DC55A87314F6D9AECBB6E74219D64834BA3141E6A0D382B1C6DF311
TrID	45.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.4% (.EXE) Win64 Executable (generic) (10523/12/4) 9.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.6% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	000808480a020400 (1 x Tosee)
Reporter	andretavare5
Tags:	exe Tosee

andretavare5

Sample downloaded from http://gons22cl.top/build.exe

Intelligence

File Origin

# of uploads :

# of downloads :

325

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/459118/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware lolbin shell32

Link:

https://www.filescan.io/uploads/6559f0171b9097ec4e75e84a/reports/f264d7ef-bbf6-41cf-93b8-f7df3b92be30/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/bc182c1ad875034766bf6f30db48ccd680a19757d51c21624d40c29f8609eb9f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2aeb9ba1-bc67-44b1-beb6-5553b9abc838

Result

Threat name:

Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1344729

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contain functionality to detect virtual machines

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking computer name)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Yara detected AntiVM3

Yara detected Vidar

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bc182c1ad875034766bf6f30db48ccd680a19757d51c21624d40c29f8609eb9f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bc182c1ad875034766bf6f30db48ccd680a19757d51c21624d40c29f8609eb9f/

Threat name:

Win32.Backdoor.Tofsee

Status:

Malicious

First seen:

2023-11-19 11:23:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xqmcygwyoubuozv7n4ynwsgm22akdf2x2uoccysnidbj7bqj5opq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/231119-ng5awshf47/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Checks installed software on the system

Checks computer location settings

Deletes itself

Reads data files stored by FTP clients

Downloads MZ/PE file

Unpacked files

SH256 hash:

038cc1f0f44c6c6ec1c71e3952357a04ed52fb70b4ed110d2c6d178e910cb552

MD5 hash:

b1e3ae8d4c67578f054d25c69ce5139a

SHA1 hash:

6a3e1115f8aa9a0cd4b0901f5d55d12566cd6c04

Detections:

INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Link:

https://www.unpac.me/results/14e585e3-bee4-47d1-829f-9a29ca39054e/

Parent samples :

1df3ca3f121e7606f16c05fbec1f2d97925002242cf534118f522664ba689a52
82c275cb45227b5f3b3d6b222a1e1b4a52f37d0de58655fd8daaa71efc4e0d1b
72363354fdb8847c45c1dc44e2a87a20da0fa04d52c2afddd24f8050a260b99b
a50880d6cbbc39560c99a3999e2b1fd0df3f0d5855a0f638a27489747a7f8877
bc182c1ad875034766bf6f30db48ccd680a19757d51c21624d40c29f8609eb9f
2b64b187c3f36ebcfeb40e5f975d923167d4e981cae7f4e2861611d1e1ae036d
44f7e32d9d153692bf8e985566a42e118711c5c7c458354d9d2b8da8d3ecb34d
3d6f60107b831b2c10f7788c2c47f9ca6c3804b42f83e77c6e5e9993b7392378

SH256 hash:

bc182c1ad875034766bf6f30db48ccd680a19757d51c21624d40c29f8609eb9f

MD5 hash:

1745b614ef0599b757d8b96daa503bc1

SHA1 hash:

b0bacd5f4a7de6f19c00ec0f4835f6bb48bcb7f4

Link:

https://www.unpac.me/results/14e585e3-bee4-47d1-829f-9a29ca39054e/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bc182c1ad875/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bc182c1ad875034766bf6f30db48ccd680a19757d51c21624d40c29f8609eb9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.