MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8ebdb9d8aed9667ad6cca1bf8a89e644a974047745aae45cad16129a18ee1cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8ebdb9d8aed9667ad6cca1bf8a89e644a974047745aae45cad16129a18ee1cb
SHA3-384 hash: acaf6e61642f63a598bdc1fab1482a16a9849aec3eb961ca8e9ede37f62cb61eccf340e1de7e1c9a0f48e4eb4ef1f32a
SHA1 hash: 92920727fe3b3d7c9d5a957a6083df1a13817a30
MD5 hash: dc7bce9efc464f2a84ad082d24b52262
humanhash: whiskey-robert-carbon-green
File name:detail.txt.lnk
Download: download sample
Signature Stealc
Create hunting rule
File size:1'728 bytes
First seen:2025-10-23 06:02:30 UTC
Last seen:Never
File type:Shortcut (lnk) lnk
MIME type:application/x-ms-shortcut
ssdeep 12:8WUm/3BVSXvk44X3ojsqzKtnWNtW+UcCsvXlZs8MIaH1DiN37+lbYUZI8:8k/BHYVKVWO+/CW1ZsPIoarab7Z
Threatray 111 similar samples on MalwareBazaar
TLSH T1BC31C0181EE21314D6B6C739ACFA631289277845DEB18B9E019C5A486B27215F4A8F2F
Magika lnk
Reporter abuse_ch
Tags:lnk Stealc

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
SE SE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28759.LnkHeur.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.DottedQuadDancingInHeaven.20220622.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.LOLBinOddLookPSHELL.20220711.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.HTTPDottedQuadPolicykill.20220908.UNOFFICIAL
Create hunting rule

TwinWave.EvilLNK.SilverChairs4SilverBacks.20221114.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68f920ba3edd081eba40d850
Tags:
obfuscate cobalt xtreme remo
Result
Verdict:
Malicious
File Type:
LNK File - Malicious
Link:
https://app.docguard.net/c8ebdb9d8aed9667ad6cca1bf8a89e644a974047745aae45cad16129a18ee1cb/results/dashboard
Payload URLs
URL
File name
http://84.200.80.22/detailstage.mp4
LNK File
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/68f9c57bfd2d7e012f4cb623/reports/16a19f61-9f3f-498f-b74e-ee329352efac/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c8ebdb9d8aed9667ad6cca1bf8a89e644a974047745aae45cad16129a18ee1cb
Verdict:
Malicious
File Type:
lnk
First seen:
2025-10-22T15:13:00Z UTC
Last seen:
2025-10-23T10:13:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan.Multi.GenBadur.genw HEUR:Trojan.WinLNK.Agent.gen HEUR:Trojan.Multi.Powedon.a Trojan-Downloader.Agent.HTTP.C&C Trojan.WinLNK.Agent.sb HEUR:Trojan.WinLNK.ZDI-CAN-25373.gen NetTool.PowerShellUA.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C
Link:
https://opentip.kaspersky.com/c8ebdb9d8aed9667ad6cca1bf8a89e644a974047745aae45cad16129a18ee1cb/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1800334
Signature
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for submitted file
Uses an obfuscated file name to hide its real file extension (double extension)
Windows shortcut file (LNK) contains suspicious command line arguments
Windows shortcut file (LNK) starts blacklisted processes
Yara detected LNK With Padded Argument
Behaviour
Behavior Graph:
Download SVG
Verdict:
Malware
YARA:
2 match(es)
Tags:
Batch Command Execution: CMD in LNK Execution: PowerShell in LNK LNK LOLBin LOLBin:powershell.exe Malicious PowerShell PowerShell Call T1059.001 T1059.003 T1202: Indirect Command Execution T1204.002
Link:
https://app.malva.re/file/dc7bce9efc464f2a84ad082d24b52262
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c8ebdb9d8aed9667ad6cca1bf8a89e644a974047745aae45cad16129a18ee1cb/
Verdict:
Malicious
Threat:
Family.STEALC
Link:
https://tip.neiki.dev/file/c8ebdb9d8aed9667ad6cca1bf8a89e644a974047745aae45cad16129a18ee1cb
Threat name:
Shortcut.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-10-22 18:21:47 UTC
File Type:
Binary
AV detection:
16 of 37 (43.24%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zdv5xhmk5wlgpllmzin7rke6mrfjoqchornk4rok2fqstimo4hfq._file
Verdict:
malicious
Label(s):
stealc
Create hunting rule
Similar samples:
39ff969553fc1bb48c6aac9e81eb95a2f565f9281ec7a0ece09363d558f65ca1
Stealc
468b1a3d163c9123ff825af496e42cc29a7c8d2fd63bd5593f411f22150c76c8
Stealc
5469a41e3e13d8051f9494e4a0526fc1e867f5a1e853fd6970e885622b689f68
Stealc
55f4b41cf0f7303afb52d47652f2f8cf170756c40357407bada780ed7c3e7062
Stealc
6b1a8a5fced3fa366a2a2675db5d8769017e32bd971f19685b9f0bfa71317034
Stealc
93ef9fe8bed1061e8fe615bd1ac409f3e9a1eab0088475a666f2fe31acdb398b
Stealc
940aef49acfa551819abd2fe1c129ea9ae18132c7ddb845546aa3a4b71ecf4b7
Stealc
b18cd8298c426e65a3cfa5039f3ff7352aefdfe7e39e26f68882f50962fe9ad3
Stealc
e71791df2374d47d1aaef8ea6af385af8d79ac1f63a28a2404b60e906fee2dab
Stealc
error
Stealc
+ 101 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution ransomware spyware stealer
Link:
https://tria.ge/reports/251023-gtccbafx8b/
Behaviour
Checks processor information in registry
Modifies registry class
Opens file in notepad (likely ransom note)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Badlisted process makes network request
Malware family:
Stealc.v2
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c8ebdb9d8aed/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c8ebdb9d8aed9667ad6cca1bf8a89e644a974047745aae45cad16129a18ee1cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Download_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies download artefacts in shortcut (LNK) files.
Rule name:EXT_EXPL_ZTH_LNK_EXPLOIT_A
Create hunting rule
Author:Peter Girnus
Description:This YARA file detects padded LNK files designed to exploit ZDI-CAN-25373.
Reference:https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
Rule name:PS_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies PowerShell artefacts in shortcut (LNK) files.
Rule name:SUSP_LNK_PowerShell
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference to powershell inside an lnk file, which is suspicious
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Shortcut (lnk) lnk c8ebdb9d8aed9667ad6cca1bf8a89e644a974047745aae45cad16129a18ee1cb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3683989/
  
Delivery method
Distributed via web download

Comments