MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 15


Intelligence 15 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293
SHA3-384 hash: 338102b4a7a961e3391bf24fe2d8d961009fca767519ab55073fe711dbeed4facf1df33441a950405de6b642c1bf1985
SHA1 hash: 2b99e13868f51f3e81d7677c528d75fc1bca2102
MD5 hash: 0194d0d6488ca775087ababc0a290b8d
humanhash: timing-solar-mississippi-whiskey
File name:0194d0d6488ca775087ababc0a290b8d.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:1'015'808 bytes
First seen:2023-12-18 22:25:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 24576:vy2t9VZGekdBSk9EiEwxCu/jGRVaQMNF3:62Z9kdn/lS6QM
Threatray 628 similar samples on MalwareBazaar
TLSH T1CE252313ABD45177D9A4377064FA1AC30232FC620E358737778AA99D0C729E4B6317AB
TrID 41.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
22.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
11.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
7.5% (.EXE) Win64 Executable (generic) (10523/12/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:exe Stealc


Avatar
abuse_ch
Stealc C2:
77.105.132.87:17066

Intelligence

File Origin
# of uploads :
1
# of downloads :
419
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
RisePro
Create hunting rule
Link:
https://www.capesandbox.com/analysis/468357/
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Launching a process
Sending a custom TCP request
Behavior that indicates a threat
Searching for the browser window
DNS request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
advpack anti-vm CAB control explorer installer installer lolbin packed rundll32 setupapi sfx shell32 stealer xpack
Link:
https://www.filescan.io/uploads/6580c6fef4b6e5e1634f71bf/reports/d0d72a9a-6e28-48c2-ac32-9de7d22a4b8d/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1c8a45f3-967f-4619-96b4-3fe18c6f4f78
Result
Threat name:
Glupteba, RedLine, RisePro Stealer, Smok
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1364197
Signature
.NET source code contains very large array initializations
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Contains functionality to modify clipboard data
Creates a thread in another existing process (thread injection)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
DLL side loading technique detected
Found API chain indicative of sandbox detection
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found Tor onion address
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies Windows Defender protection settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Phishing site detected (based on logo match)
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses process hollowing technique
Suspicious execution chain found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
UAC bypass detected (Fodhelper)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Generic Downloader
Yara detected Glupteba
Yara detected RedLine Stealer
Yara detected RisePro Stealer
Yara detected SmokeLoader
Yara detected Vidar stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1364197 Sample: 1grVKS95J5.exe Startdate: 18/12/2023 Architecture: WINDOWS Score: 100 176 Found malware configuration 2->176 178 Malicious sample detected (through community Yara rule) 2->178 180 Antivirus detection for URL or domain 2->180 182 18 other signatures 2->182 10 1grVKS95J5.exe 1 4 2->10         started        13 svchost.exe 2->13         started        15 svchost.exe 1 1 2->15         started        18 4 other processes 2->18 process3 dnsIp4 136 C:\Users\user\AppData\Local\...\yN7FG91.exe, PE32 10->136 dropped 138 C:\Users\user\AppData\Local\...\6Zb0Qo5.exe, PE32 10->138 dropped 20 6Zb0Qo5.exe 10->20         started        23 yN7FG91.exe 1 4 10->23         started        26 WerFault.exe 13->26         started        28 WerFault.exe 13->28         started        160 23.204.76.112 AKAMAI-ASN1EU United States 15->160 162 127.0.0.1 unknown unknown 15->162 30 chrome.exe 18->30         started        file5 process6 file7 214 Antivirus detection for dropped file 20->214 216 Machine Learning detection for dropped file 20->216 218 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 20->218 224 4 other signatures 20->224 32 explorer.exe 20->32 injected 114 C:\Users\user\AppData\Local\...\4kW069ht.exe, PE32 23->114 dropped 116 C:\Users\user\AppData\Local\...\1TI59DO5.exe, PE32 23->116 dropped 220 Multi AV Scanner detection for dropped file 23->220 222 Binary is likely a compiled AutoIt script file 23->222 37 4kW069ht.exe 23->37         started        39 1TI59DO5.exe 12 23->39         started        signatures8 process9 dnsIp10 140 185.215.113.68 WHOLESALECONNECTIONSNL Portugal 32->140 142 5.42.65.125 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 32->142 144 5 other IPs or domains 32->144 96 C:\Users\user\AppData\Roaming\etufajf, PE32 32->96 dropped 98 C:\Users\user\AppData\Local\Temp\D4E8.exe, PE32 32->98 dropped 100 C:\Users\user\AppData\Local\Temp\A4B0.exe, PE32 32->100 dropped 102 5 other malicious files 32->102 dropped 184 System process connects to network (likely due to code injection or exploit) 32->184 186 Benign windows process drops PE files 32->186 188 Hides that the sample has been downloaded from the Internet (zone.identifier) 32->188 41 5749.exe 32->41         started        45 1CC0.exe 32->45         started        47 3F7.exe 32->47         started        58 4 other processes 32->58 190 Multi AV Scanner detection for dropped file 37->190 192 Contains functionality to inject code into remote processes 37->192 194 Writes to foreign memory regions 37->194 202 2 other signatures 37->202 50 AppLaunch.exe 21 40 37->50         started        52 AppLaunch.exe 37->52         started        196 Binary is likely a compiled AutoIt script file 39->196 198 Found API chain indicative of sandbox detection 39->198 200 Contains functionality to modify clipboard data 39->200 54 chrome.exe 39->54         started        56 chrome.exe 39->56         started        60 7 other processes 39->60 file11 signatures12 process13 dnsIp14 118 C:\Users\user\AppData\Local\Temp\tuc3.exe, PE32 41->118 dropped 120 C:\Users\user\AppData\Local\...\toolspub2.exe, PE32 41->120 dropped 122 C:\Users\user\AppData\...\InstallSetup9.exe, PE32 41->122 dropped 124 C:\...\31839b57a4f11171d6abc8bbc4451ee4.exe, PE32 41->124 dropped 226 Antivirus detection for dropped file 41->226 228 Multi AV Scanner detection for dropped file 41->228 230 Machine Learning detection for dropped file 41->230 62 toolspub2.exe 41->62         started        65 31839b57a4f11171d6abc8bbc4451ee4.exe 41->65         started        67 InstallSetup9.exe 41->67         started        73 2 other processes 41->73 126 C:\Users\user\AppData\...\Protect544cd51a.dll, PE32 45->126 dropped 232 Sample uses process hollowing technique 45->232 75 3 other processes 45->75 164 77.105.132.87 PLUSTELECOM-ASRU Russian Federation 47->164 234 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 47->234 236 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 47->236 166 91.92.249.253 THEZONEBG Bulgaria 50->166 168 34.117.186.192 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 50->168 128 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 50->128 dropped 130 C:\...\IO9b3cakAxaZPFwiqbdhAK710fBbjzDP.zip, Zip 50->130 dropped 132 C:\Users\user\AppData\...\FANBooster131.exe, PE32 50->132 dropped 134 2 other files (none is malicious) 50->134 dropped 238 Found many strings related to Crypto-Wallets (likely being stolen) 50->238 240 Tries to harvest and steal browser information (history, passwords, etc) 50->240 242 Disables Windows Defender Tamper protection 50->242 248 2 other signatures 50->248 77 15 other processes 50->77 244 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 52->244 250 3 other signatures 52->250 246 Suspicious execution chain found 54->246 71 chrome.exe 54->71         started        170 192.168.2.4 unknown unknown 56->170 172 192.168.2.5 unknown unknown 56->172 174 239.255.255.250 unknown Reserved 56->174 79 3 other processes 56->79 81 7 other processes 60->81 file15 signatures16 process17 dnsIp18 252 Multi AV Scanner detection for dropped file 62->252 254 Detected unpacking (changes PE section rights) 62->254 256 Injects a PE file into a foreign processes 62->256 83 toolspub2.exe 62->83         started        258 Antivirus detection for dropped file 65->258 260 Detected unpacking (overwrites its own PE header) 65->260 262 UAC bypass detected (Fodhelper) 65->262 274 3 other signatures 65->274 146 173.231.16.77 WEBNXUS United States 67->146 156 2 other IPs or domains 67->156 104 C:\Users\user\AppData\Local\Temp\...\Math.dll, PE32 67->104 dropped 106 C:\Users\user\AppData\Local\...\INetC.dll, PE32 67->106 dropped 108 C:\Users\user\AppData\...\nsa8E87.tmp.exe, PE32 67->108 dropped 112 2 other malicious files 67->112 dropped 86 BroomSetup.exe 67->86         started        110 C:\Users\user\AppData\Local\Temp\...\tuc3.tmp, PE32 73->110 dropped 148 195.20.16.103 EITADAT-ASFI Finland 75->148 150 20.42.65.92 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 75->150 264 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 75->264 266 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 75->266 268 Tries to harvest and steal browser information (history, passwords, etc) 75->268 152 20.189.173.20 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 77->152 270 Found many strings related to Crypto-Wallets (likely being stolen) 77->270 272 Uses schtasks.exe or at.exe to add and modify task schedules 77->272 88 conhost.exe 77->88         started        90 conhost.exe 77->90         started        92 conhost.exe 77->92         started        94 13 other processes 77->94 154 104.244.42.193 TWITTERUS United States 79->154 158 78 other IPs or domains 79->158 file19 signatures20 process21 signatures22 204 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 83->204 206 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 83->206 208 Maps a DLL or memory area into another process 83->208 212 2 other signatures 83->212 210 Multi AV Scanner detection for dropped file 86->210
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293
Detection:
smokeloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-12-18 22:26:06 UTC
File Type:
PE (Exe)
Extracted files:
100
AV detection:
19 of 37 (51.35%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xzy7g3o6vcgexi2chfhcanjnmd5hzvq4xjyektv2e4hz6smwwkjq._file
Verdict:
unknown
Similar samples:
0c7117e7bd2eb23d5205b3dac031ad2ed5a636488c2f54eb3d6003262f03e2a2
Stealc
1208eb5fcec2b7c18202685bd7d17706583d6b207bc15242c316cb27a2de2691
Stealc
291c90471067e7f436eb304a29c3df2b25a0176b370453d41c218202abec8e08
Stealc
5560b3501a49afd86cefe836f79f159f49adced11ccecf92b5d6651edd292c94
Stealc
6b362b2e24b31baf1345b1510806cdd4ac3af1ad704881421ceae5360312eed8
Stealc
71334cb3df06b322134688d24e5b8620d691a38ac42d72c5c0071b3de563fcb4
Stealc
7da7d8176b9c386e2102b47341b29817c3ac5f2fb4f27a26ec70b3a00c900019
Stealc
d4ad4eac1146c73f44b7bf25f3356a78d5764a300998bb8ca8f4cb2df9cbdaba
Stealc
e2336251279843322a02ee9337cc650d5b14a6684fe40377c8fed6529a7e370c
Stealc
f8e284bd0abd20b927c85a295144921ccdb547701cc0bf724f9ca60fbaea124e
Stealc
+ 618 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader family:zgrat botnet:666 botnet:livetraffic botnet:up3 backdoor brand:google collection evasion infostealer persistence phishing rat trojan
Link:
https://tria.ge/reports/231218-2cg7fsdffn/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Enumerates system info in registry
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
AutoIT Executable
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
Detect ZGRat V1
Detected google phishing page
Modifies Windows Defender Real-time Protection settings
RedLine
RedLine payload
SmokeLoader
ZGRat
Malware Config
C2 Extraction:
http://185.215.113.68/fks/index.php
77.105.132.87:17066
195.20.16.103:18305
Unpacked files
SH256 hash:
e53f443bee5f8148aa3d68639957c064ef516d6a6ff5dae64a56ee632aaccfe2
MD5 hash:
b7e4c127171b30fa351eb7a5b2fdaceb
SHA1 hash:
a020b74827333d09be895611e037bc7b17400681
Link:
https://www.unpac.me/results/2b2b40d9-2565-4193-a0c6-d50e64f221a7/
SH256 hash:
fb2ffd61b1600b318a5814d60601afd0d9b4602b6fb4bf8e13f21da7fff2cabd
MD5 hash:
51056dd7b1a40e49623a28e27ef8aa19
SHA1 hash:
4f603d1c71429f03a7762347845ba1d0f8c47b10
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/2b2b40d9-2565-4193-a0c6-d50e64f221a7/
Parent samples :
f127cc97b1804964609ab8d528fd50cb1f3310ec2e710eb55c443c8d53362d98
af1a26b503f91e02a849536f18cc7dc1557e6e370e91406bdc35026133747fa0
70d432aaae6f900cb7d7e8cc0d4b78551d905d1ac9e208d4c73c4ead3b4f97a4
860a74f2c49fc7e3fc54b1d244a477a590a4410c583455eacd59772127842db4
1521933f23997a26e16971725acdeb119b82ab21f50283ee04aa7d73ce7484e5
d6bf6348e3239e54a171e41be3c23d4a515a44c495075afa639a9d2946f4ce2a
dfac5e31b117e359591781d0e6614b49226d3ef3461f2d020133f5044be3befc
aa6109131f311c7ec4cbd993ac6fb997dda5beefee5863895e36608288fcac8a
b3193fd6b06a6a466c077456ba004201be106d617aae73498c3f518b3f7f57f2
8c1bedb10049179dfe9df52eb7611d6e18ac8339b184f50a6bcbaf9a89854cf2
fec610ca26bf6c17e72f75f72a5ba1ccf4500fb3510420b29686e09338d14128
c1ffd458cc441fe5d967825862acbc540728517d0f8ec95621bd6edd1a724767
2a57a5e703adac0bd9c5a0b9a710dfe8700a1dfb21af471b9883e6d6b86c78cc
b90fc851dee3bbb480aac668be792e552bde6c4571ec9f1847da7da7f964a24f
0cd714e33c9ebb3b55d89c349099a96bf4540512eac2baee479503303116e3a8
58c5ece596efec8db43e1ab97c35ac8253b761d518a7a8ef5e311a8e274fd1a7
c085fb1e6d999dd96f4213e5f1d3d0ae061ddccc571d20eb86e645149d4fc494
953ed6e4cb1aa5d21a529c8de8c3f06176a623388810e9549f3bd91a8715c9b2
d9ad55fb79af764ef60e3508973f162266bc8a2db17155612c6b5b7155e12c1d
9f6a32eebd13b63b6f6c79c282d6059419db613fa8ac78015cc8f99bfff8a124
291c90471067e7f436eb304a29c3df2b25a0176b370453d41c218202abec8e08
82bf998ee07f0549a68b9904d760f7b0fd47ee68f08a59a26de171b6dc8ea3db
01497dea122f92d36b4e0ae4eade31511b2db302e6f7f87a695e817065834281
486271a3873f946e14f5662e2498d75c29323402c778bdf6ce0905b37619fc3a
fc1af115d47f4f6f00b3c2a06c64b4b580b76a16f8e1c122670ced300f4abf57
7d43625f6587b6539d7bc6037dcb8b0eb317a035c5deb69f79e307afa4ac4d45
949edc5ede31cf9316dedc155d8d4ca93f8da0464d2ef0d8bff52dfddcac8e41
f782933fb6a551cd97aabaf041ce9521694203199fe8a62efdfdd9dda00548e0
8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055
e96789d697301017c3c5f2332f7f74fd5aabbee70373e2d7af8c7ebd24ab22e0
be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293
a58ffa444d6514a0b092f8fa84c0a15853f5141c86abcbcf0c5b4dcc312aaf3c
44365f98d16e475a1638df59aca02415388a327b2f3738acbea8dfddec202654
7cfa46dfb53c0efee3d57af2aa83f9513c27c91e569e952c22e4b022d16e6e27
433895b81e5ef461f97327e064b25cb40284a44049e6231c0c60e6f54517138a
ce55ffbc3e022895e8e50711a4daf9b3afa4b83f42c6f0c98e76a710ae03821d
689a8c848e6cf7d5ddbdceb90aa8513c1b83a9dbe72f57a70ab419264819d107
93bb322e419ca964ae2a6340febd60d216ce342706ca4efe9c6df1fec38d238e
550e893759da573a62c1c16144f5e8fa65e6df3eabd53c60648b9ac6748c1b8c
ed73c1f42bef4d474a0eb9d82ff1257f291b9b13b3dfa73d378afbe061766f5a
5fa66d59f80ba0bb65efc157dc43cc0eeab813bfe110ef92a3765edceba281cc
SH256 hash:
d574502735f62c929f2441243be8e6df71391e99407c6f95b367c28df92975ee
MD5 hash:
d8e2d772f9c6cb735691778d05d5a037
SHA1 hash:
ec081597a180f312e2c73abb019e9b349ebe3584
Detections:
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/2b2b40d9-2565-4193-a0c6-d50e64f221a7/
Parent samples :
f782933fb6a551cd97aabaf041ce9521694203199fe8a62efdfdd9dda00548e0
8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055
be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293
7cfa46dfb53c0efee3d57af2aa83f9513c27c91e569e952c22e4b022d16e6e27
ce55ffbc3e022895e8e50711a4daf9b3afa4b83f42c6f0c98e76a710ae03821d
689a8c848e6cf7d5ddbdceb90aa8513c1b83a9dbe72f57a70ab419264819d107
SH256 hash:
78decf71dbe1c699ca74811a5a9c0d3697a156969b2ed40168ecacff0d590730
MD5 hash:
bb275dbccd853320c7e30ee9575a7abf
SHA1 hash:
2f1f323aa3a6e2a9cda2962b2f3a69e5150819e7
Detections:
INDICATOR_EXE_Packed_ConfuserEx
Create hunting rule
Link:
https://www.unpac.me/results/2b2b40d9-2565-4193-a0c6-d50e64f221a7/
Parent samples :
949edc5ede31cf9316dedc155d8d4ca93f8da0464d2ef0d8bff52dfddcac8e41
f782933fb6a551cd97aabaf041ce9521694203199fe8a62efdfdd9dda00548e0
8957d43878c36ee0ae11246393c9c1ce600536ab817435417e50af86a3f1b055
e96789d697301017c3c5f2332f7f74fd5aabbee70373e2d7af8c7ebd24ab22e0
be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293
44365f98d16e475a1638df59aca02415388a327b2f3738acbea8dfddec202654
7cfa46dfb53c0efee3d57af2aa83f9513c27c91e569e952c22e4b022d16e6e27
433895b81e5ef461f97327e064b25cb40284a44049e6231c0c60e6f54517138a
ce55ffbc3e022895e8e50711a4daf9b3afa4b83f42c6f0c98e76a710ae03821d
689a8c848e6cf7d5ddbdceb90aa8513c1b83a9dbe72f57a70ab419264819d107
93bb322e419ca964ae2a6340febd60d216ce342706ca4efe9c6df1fec38d238e
SH256 hash:
be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293
MD5 hash:
0194d0d6488ca775087ababc0a290b8d
SHA1 hash:
2b99e13868f51f3e81d7677c528d75fc1bca2102
Detections:
win_redline_wextract_hunting_oct_2023
Create hunting rule
Link:
https://www.unpac.me/results/2b2b40d9-2565-4193-a0c6-d50e64f221a7/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/be71f36ddea8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe be71f36ddea88c4ba342394e20352d60fa7cd61cba70454eba270f9f4996b293

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2738241/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/468357/

Comments