MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments

SHA256 hash:	c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0
SHA3-384 hash:	efe9775147c70e7526447488e33c0c625e01e9ebd33f83b696dc1f8253446b4a04f7714323957abebcea821f287e4793
SHA1 hash:	bfce6a6839d2fa159691eaf7ed884e93b481ed35
MD5 hash:	bb88997d394c01230d90aa731f4e8837
humanhash:	triple-seventeen-speaker-saturn
File name:	bb88997d394c01230d90aa731f4e8837.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	336'384 bytes
First seen:	2024-04-23 07:25:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c9619f19f41ef1b7d232f47cfbcc330b (11 x Stealc, 4 x Arechclient2)
ssdeep	3072:oj28kZpEZkkxwybSM+QF5XWdyFmnM8A+9VZNqxybPgr2E9vmsyH1IgYJgtKT4i9+:6kZ6/I0fT+XZNqx9yEksGhQECc
TLSH	T149649E03F2F0AC60F36346329F68B694669FFC515E25572B2E44660F66703F0E2A275E
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 15.9% (.EXE) Win32 Executable (generic) (4504/4/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	030d030121033300 (1 x Stealc)
Reporter	abuse_ch
Tags:	exe Stealc

abuse_ch

Stealc C2:
http://185.172.128.111/f993692117a3fda2.php

Intelligence

File Origin

# of uploads :

# of downloads :

314

Origin country :

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Connecting to a non-recommended domain

Connection attempt

Sending an HTTP GET request

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Verdict:

No Threat

Threat level:

10/10

Confidence:

100%

Tags:

fingerprint

Link:

https://www.filescan.io/uploads/6627628a14ba3ce8289915b7/reports/ae644e44-1d26-43aa-aafa-a9e94f515048/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Stealc

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/542f871c-cf86-4110-89e2-2aea6aa7f0bd

Result

Threat name:

Mars Stealer, Stealc, Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1430186

Signature

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Snort IDS alert for network traffic

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0/

Threat name:

Win32.Trojan.Stealerc

Status:

Malicious

First seen:

2024-04-23 07:26:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yhidhh3tv5dmmo32xbtmmwq43rrwz7nresjfq7hopo4sjbvjc7ya._file

Verdict:

malicious

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc stealer

Link:

https://tria.ge/reports/240423-h9hppsed87/

Behaviour

Program crash

Stealc

Unpacked files

SH256 hash:

743875dcc496b10bc3b30df93f050fc7660b19a0125046769fcb5eb9166d62b9

MD5 hash:

3d508dd52445d80003ea8f82924983ed

SHA1 hash:

87573bf07f77149fd531082018f784992b183795

Detections:

stealc

win_stealc_auto

Link:

https://www.unpac.me/results/b2f2b481-706b-4221-a5e0-4242460eb073/

Parent samples :

1a102b793f4cad2e1bffc0a7e25ffd3601744a616d19f7f5dbd57c8a116538b3
9bef7a636bd52f5ecd74c1f4041c73eefad5e23f8a978af0201f72cd24a9b0d0
fb63921ce0bda58d6277755b5e784e7b042f646d64ebbd230a6b9b8ab3db33d7
a4805aa4e8b2cb5956f757d210eaa3cd8d14b9f882f483473b1c5cc9c64c441d
1418981255cd087e37c0995615e09d0e969a1adafc29f7995156e0b1d4c40285
6eb4693b2a32e225a88b9bc08c8c0e609c473113214f46c08e4fc067ff37e891
d5dbffe347a31cc50559e0c91f94f47fa1f134d3678c7721685af1bdf84be133
2daf90fbe9e99b9e0378f48a8b091fa703b735760ebf32ce609b40d4648a955e
8d8e0734ba1d608ef6ee124b1d5ab196223f6eb1d50348d1eb0b6ae57cd8ad3a
4cfb75886d62c303f23ac1f5a27de1ab083e056d2a498aac104bb1e89fab3cae
0a6e0a8505b349359dc63cc92fc46f879f19f43c246eb7e2445dcaca526d70fb
4d8b8c49b376c483e08d172646b49baf697d54b815b8357008117fed39c92cb0
c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0
cb664fc08a69a03e1d7ad2d47b9d7397330601fcfd8d559149ee606d782f14ad
dadc6e78d7628c9b004c60834d4f20729bf6718b972c31ef08c3bb7181a39a7f
6b260c2a031fee21a1796091021415225b006baa888bfa2a37c3f79ca86ca9c8
a637cb5b10bcdf7d7f77c408b3e81af8f006f9e506c5fd47ef28cea8d8f7f1d3
1c3448b78546786cd23b0642700e6c05b49c786f1bbf2f14c60cfff2b378736f

SH256 hash:

c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0

MD5 hash:

bb88997d394c01230d90aa731f4e8837

SHA1 hash:

bfce6a6839d2fa159691eaf7ed884e93b481ed35

Link:

https://www.unpac.me/results/b2f2b481-706b-4221-a5e0-4242460eb073/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c1d0339f73af/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	EXE_Stealer_StealC_Feb2024 Create hunting rule
Author:	Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe c1d0339f73af46c63b7ab866c65a1cdc636cfdb12492587cee7bb92486a917f0

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2754939/

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2812849/

URLhaus

https://urlhaus.abuse.ch/url/2810818/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetVolumeInformationA KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::AddConsoleAliasW KERNEL32.dll::AddConsoleAliasA KERNEL32.dll::WriteConsoleA KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleInputW KERNEL32.dll::SetStdHandle
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateHardLinkA KERNEL32.dll::CreateFileW KERNEL32.dll::GetWindowsDirectoryW KERNEL32.dll::RemoveDirectoryW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameA
WIN_HTTP_API	Uses HTTP services	WINHTTP.dll::WinHttpConnect

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample