🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbcf86c578bc0b0b142cf828308908755aa3a8c92160628fe0e12ecaba282126. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 12


Intelligence 12 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbcf86c578bc0b0b142cf828308908755aa3a8c92160628fe0e12ecaba282126
SHA3-384 hash: d3f257e424066db0313763f946512d3baed1f8d6284b95bd6d0e3959b7608f304a6043d486587f7c54e5dbd334f4f3a1
SHA1 hash: 5252d53cf28420e3da0b2855c694428dece3865f
MD5 hash: c9b1ebd513971eecad23fcba92de12d8
humanhash: march-connecticut-don-kentucky
File name:Setup.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:10'267'261 bytes
First seen:2025-12-19 17:48:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash dcaf48c1f10b0efa0a4472200f3850ed (716 x Efimer, 60 x BlankGrabber, 23 x SalatStealer)
ssdeep 196608:Rqp7Ot0o8uLJZ2U/jiXurHtQ3qemdUSCtNIGaoMi6FnM9qgslmzE:R4Kt0zuLf2U/jiXuZ6mdUSCUMwh0E
TLSH T1D0A63310EB9358E6F9F7857ECA2255A7D1223C439B61CBF707B002520DA32E57B3A275
TrID 66.6% (.EXE) InstallShield setup (43053/19/16)
16.2% (.EXE) Win64 Executable (generic) (10522/11/4)
7.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.1% (.EXE) OS/2 Executable (generic) (2029/13)
3.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon f0d2d8c488acb4ec (64 x SantaStealer, 36 x Stealc, 3 x DonutLoader)
Reporter burger
Tags:exe Stealc

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
PyInstaller
Details
PyInstaller
a compiled assembly and a Python version
Link:
https://research.acce.ciphertechsolutions.com/results/1553566a-e0b5-4799-b295-c2759c62b5a0/
Malware family:
n/a
ID:
1
File name:
Setup.exe
Verdict:
Malicious activity
Analysis date:
2025-12-19 17:48:11 UTC
Tags:
python auto-reg pyinstaller crypto-regex
Link:
https://app.any.run/tasks/c5e83695-a55a-49c6-b9eb-ae6dc3a26971

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45534/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6945903456a871e6bb7f0e84
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
expand installer-heuristic invalid-signature lolbin microsoft_visual_cc overlay overlay packed pyinstaller signed
Link:
https://www.filescan.io/uploads/694590215ceddcfa3ff626a6/reports/137e42d2-52da-462d-bdac-69a22cad508a/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/cbcf86c578bc0b0b142cf828308908755aa3a8c92160628fe0e12ecaba282126
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-12-19T12:51:00Z UTC
Last seen:
2025-12-20T16:59:00Z UTC
Hits:
~100
Detections:
Trojan-Banker.Win32.Express.sb Trojan-Banker.Win32.ClipBanker.sb Trojan-Banker.Win32.ClipBanker.agns Trojan.Win32.Agent.sb PDM:Trojan.Win32.Generic VHO:Trojan-Banker.Win32.ClipBanker.gen Trojan-Spy.Win32.Clipper.sba Trojan-PSW.Win32.Coins.sb
Link:
https://opentip.kaspersky.com/cbcf86c578bc0b0b142cf828308908755aa3a8c92160628fe0e12ecaba282126/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/5c9f41df-a25c-4051-a99b-90dcf9e03284
Result
Threat name:
MicroClip, Stealc v2
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1836439
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Early bird code injection technique detected
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Found pyInstaller with non standard icon
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses string decryption to hide its real strings
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected MicroClip
Yara detected Stealc v2
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1836439 Sample: Setup.exe Startdate: 19/12/2025 Architecture: WINDOWS Score: 100 77 Suricata IDS alerts for network traffic 2->77 79 Found malware configuration 2->79 81 Malicious sample detected (through community Yara rule) 2->81 83 7 other signatures 2->83 8 Setup.exe 56 2->8         started        12 JavaUpdate.exe 56 2->12         started        14 JavaUpdate.exe 56 2->14         started        process3 file4 49 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 8->49 dropped 51 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32+ 8->51 dropped 53 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 8->53 dropped 61 51 other files (none is malicious) 8->61 dropped 99 Found pyInstaller with non standard icon 8->99 16 Setup.exe 1 8 8->16         started        55 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 12->55 dropped 57 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32+ 12->57 dropped 59 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 12->59 dropped 63 51 other files (none is malicious) 12->63 dropped 19 JavaUpdate.exe 12->19         started        65 54 other files (none is malicious) 14->65 dropped 21 JavaUpdate.exe 14->21         started        signatures5 process6 file7 43 C:\Users\user\AppData\...\JavaUpdate.exe, PE32+ 16->43 dropped 45 C:\Users\user\AppData\Local\...\program.exe, PE32+ 16->45 dropped 47 C:\Users\...\JavaUpdate.exe:Zone.Identifier, ASCII 16->47 dropped 23 program.exe 16->23         started        26 JavaUpdate.exe 56 16->26         started        29 cmd.exe 1 19->29         started        31 cmd.exe 21->31         started        process8 file9 89 Early bird code injection technique detected 23->89 91 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 23->91 93 Writes to foreign memory regions 23->93 97 4 other signatures 23->97 33 dllhost.exe 12 23->33         started        67 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 26->67 dropped 69 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32+ 26->69 dropped 71 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 26->71 dropped 73 51 other files (none is malicious) 26->73 dropped 95 Found pyInstaller with non standard icon 26->95 37 JavaUpdate.exe 26->37         started        39 conhost.exe 29->39         started        41 conhost.exe 31->41         started        signatures10 process11 dnsIp12 75 62.60.178.9, 49724, 80 ASLINE-AS-APASLINELIMITEDHK Iran (ISLAMIC Republic Of) 33->75 85 Contains functionality to inject code into remote processes 33->85 87 Unusual module load detection (module proxying) 33->87 signatures13
Score:
79%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cbcf86c578bc0b0b142cf828308908755aa3a8c92160628fe0e12ecaba282126
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/c9b1ebd513971eecad23fcba92de12d8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cbcf86c578bc0b0b142cf828308908755aa3a8c92160628fe0e12ecaba282126/
Verdict:
Malicious
Threat:
VHO:Trojan-Banker.Win32.ClipBanker
Link:
https://tip.neiki.dev/file/cbcf86c578bc0b0b142cf828308908755aa3a8c92160628fe0e12ecaba282126
Threat name:
Win64.Infostealer.ClipBanker
Create hunting rule
Status:
Suspicious
First seen:
2025-12-19 17:48:11 UTC
File Type:
PE+ (Exe)
Extracted files:
508
AV detection:
7 of 37 (18.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zphynrlyxqfqwfbm7audbciiovnkhkgjefqgfd7a4exmvorieeta._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence pyinstaller
Link:
https://tria.ge/reports/251223-qeecsszpaw/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Detects Pyinstaller
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e62021d3-e84c-41cb-b2ed-802c77078afd
Unpacked files
SH256 hash:
cbcf86c578bc0b0b142cf828308908755aa3a8c92160628fe0e12ecaba282126
MD5 hash:
c9b1ebd513971eecad23fcba92de12d8
SHA1 hash:
5252d53cf28420e3da0b2855c694428dece3865f
Link:
https://www.unpac.me/results/f405a2d8-9f05-4f76-b479-d8c61d744684/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/45534/

Comments