MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0e7a341fe199dbabb5f0798dba0564e9b60e4736a405c46eafc7232cc10dc40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MarsStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0e7a341fe199dbabb5f0798dba0564e9b60e4736a405c46eafc7232cc10dc40
SHA3-384 hash: c0fbb8b745bf16283d93bc3513cc6dd67b8a3246d078a8efdea7bc66a8550bbcc7258e437b0369674e0bd676a2592368
SHA1 hash: 648fb92b95cb2778fbea7befa05a4951d4420597
MD5 hash: c6f4f0c4a37d871e0169497501b3b2d4
humanhash: beryllium-blue-helium-black
File name:c6f4f0c4a37d871e0169497501b3b2d4.exe
Download: download sample
Signature MarsStealer
Create hunting rule
File size:357'376 bytes
First seen:2023-07-27 07:11:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a7b2964ab4bd39b47423afee5d4f43a3 (1 x MarsStealer, 1 x Smoke Loader)
ssdeep 3072:+R2QHuiUkLvy+rtGWT8xObXB3DzE7pkgJV/7xi5EjEhwlGvPGT1hy8:dQTUkLvtGK8QXBzASgJlxXYhjv+
Threatray 44 similar samples on MalwareBazaar
TLSH T1A774B66383E2BD44E9258B729F3FCAE8760DF6508F4D7B65A1299E2F00B51B2D173610
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
16.0% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 1030c09010301000 (1 x Stop, 1 x MarsStealer)
Reporter abuse_ch
Tags:exe MarsStealer

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
oski
Create hunting rule
ID:
1
File name:
c6f4f0c4a37d871e0169497501b3b2d4.exe
Verdict:
Malicious activity
Analysis date:
2023-07-27 07:16:07 UTC
Tags:
lumma stealc stealer oski loader
Link:
https://app.any.run/tasks/cb34bce6-5a05-498b-88e6-572bdd51144d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/434688/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/64c218c96635e735db260ebc/reports/7a1f62e1-55e0-4c83-9f3a-8e101c2aaa8b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/d0e7a341fe199dbabb5f0798dba0564e9b60e4736a405c46eafc7232cc10dc40
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Oski Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/07e06f21-0f40-45c9-a777-01c9ea0d7b73
Result
Threat name:
Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1280911
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d0e7a341fe199dbabb5f0798dba0564e9b60e4736a405c46eafc7232cc10dc40/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-07-27 05:48:57 UTC
File Type:
PE (Exe)
Extracted files:
84
AV detection:
28 of 37 (75.68%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2dt2gqp6dgo3vo27a6mnxicwj2nwbzdtnjafyrxk7rzdftaq3raa._file
Verdict:
malicious
Similar samples:
020fd62d72e2fc52bd24929f59613f75ea345b8062c7afbd8cdc6d55243d7839
MarsStealer
046d23bc4411e3fe3a0b2440e505a86751897f44c99d9a73bfac15b49dd9b399
MarsStealer
08e063b7a0c135f5df7910c9a18b21de53e72ad9ade8e9d72e14a6e933f27634
MarsStealer
28d2d3f89f2b35af444964926c1bce39f7ae2d86e3f0864cb6028252b37fca21
MarsStealer
29f23979e3b541ca8955fcbd3a0f9cadbdf92c0df65ba495eeb98bd1e154bc6d
MarsStealer
2a7ccf835cd47e53b218d02824e1db7194aa045271d10a049647528a865c723f
MarsStealer
8afd72197f13d7016291b5799cb9e680146d09b9b06661bb0de3f7972ef56fdc
MarsStealer
970a7ff3bab4b5fffe226cf5e66d997c9a8692623c2fa17fb5e2d35b16686564
MarsStealer
dad7e37e790b7fe49cb37bbd4947d5feac52fcf2240490b36f52ef97dc84bc4c
MarsStealer
ea73f0c424fb7780689b5d0b88bcef9af3b80ed701250ebf8c794b89aea182a4
MarsStealer
+ 34 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/230727-h1hcksbc2t/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Unpacked files
SH256 hash:
a67ebefdcae4ba5d76bce770a4920256e84195bef3a4702d967be7e5b8181c12
MD5 hash:
7055fcde2b7f39ef7f8007b3bfc1a0bf
SHA1 hash:
676adecade4e2b6c3275ca39ac65059c1863509f
Link:
https://www.unpac.me/results/63736e79-4701-4897-9b99-1c287a2bc404/
SH256 hash:
d0e7a341fe199dbabb5f0798dba0564e9b60e4736a405c46eafc7232cc10dc40
MD5 hash:
c6f4f0c4a37d871e0169497501b3b2d4
SHA1 hash:
648fb92b95cb2778fbea7befa05a4951d4420597
Link:
https://www.unpac.me/results/63736e79-4701-4897-9b99-1c287a2bc404/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d0e7a341fe19/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_Mars_Stealer
Create hunting rule
Author:@malgamy12
Description:detect_Mars_Stealer
Rule name:infostealer_win_stealc_standalone
Create hunting rule
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/
Rule name:sus_pe_free_without_allocation
Create hunting rule
Author:Maxime THIEBAUT (@0xThiebaut)
Description:Detects an executable importing functions to free memory without importing allocation functions, often indicative of dynamic import resolution
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security
Rule name:win_stealc_w0
Create hunting rule
Author:crep1x
Description:Find standalone Stealc sample based on decryption routine or characteristic strings
Reference:https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MarsStealer

Executable exe d0e7a341fe199dbabb5f0798dba0564e9b60e4736a405c46eafc7232cc10dc40

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2690247/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/434688/

Comments