MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d11dbe59e05a1104b99aebac58e06bebfd85cf9b269082184cbc67e28f57b2b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d11dbe59e05a1104b99aebac58e06bebfd85cf9b269082184cbc67e28f57b2b7
SHA3-384 hash: add8a5df735264f9a60f642dd6d2f8cf6c178e898709ab375c137d0c89ac16a570606c7f86f6ba75f0c73bdcaa935974
SHA1 hash: 115c36b09447dfc618bd5d6a53fae9058027c23a
MD5 hash: 817d4a2631ba6ee72587b33a850901e8
humanhash: mars-helium-ack-oscar
File name:817d4a2631ba6ee72587b33a850901e8.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:6'427'136 bytes
First seen:2023-12-20 16:05:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 98304:Pb+P1ebZBonHd5DOf2fFJyWHW4HoZWzy4+UN2rV58N5wIVTt2/GVXrpJWttuid:SP1ebZG9EE5hHgANkz8cIBg+VXrsx
Threatray 2'094 similar samples on MalwareBazaar
TLSH T1D356335667A805B2DCF923B42CF3A2070822B8A057B8837BA60DD9451D97FD4BC753DE
TrID 41.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
22.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
11.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
7.5% (.EXE) Win64 Executable (generic) (10523/12/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:exe Stealc


Avatar
abuse_ch
Stealc C2:
193.233.132.70:13246

Intelligence

File Origin
# of uploads :
1
# of downloads :
354
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/468640/
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Launching a process
Behavior that indicates a threat
Searching for the browser window
DNS request
Sending a custom TCP request
Reading critical registry keys
Searching for the window
Running batch commands
Verdict:
Malicious
Threat level:
  10/10
Confidence:
89%
Tags:
advpack anti-vm CAB control explorer installer lolbin net packed rundll32 setupapi sfx shell32
Link:
https://www.filescan.io/uploads/658310ee314dbc3b9b594d00/reports/413333a7-036c-4825-9990-6f958c36fcf4/overview
Verdict:
Malicious
Labled as:
Kryptik.JKR.gen
Link:
https://www.hybrid-analysis.com/sample/d11dbe59e05a1104b99aebac58e06bebfd85cf9b269082184cbc67e28f57b2b7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/e92681ca-431c-4e50-bf58-4603b98b397b
Result
Threat name:
RisePro Stealer, SmokeLoader, Vidar, zgR
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1365157
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Binary is likely a compiled AutoIt script file
Contains functionality to modify clipboard data
Detected unpacking (changes PE section rights)
Found API chain indicative of sandbox detection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
PE file contains section with special chars
PE file has a writeable .text section
Phishing site detected (based on logo match)
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Snort IDS alert for network traffic
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Generic Downloader
Yara detected RisePro Stealer
Yara detected SmokeLoader
Yara detected Vidar stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1365157 Sample: mxeGE4LCfj.exe Startdate: 20/12/2023 Architecture: WINDOWS Score: 100 118 youtube-ui.l.google.com 2->118 120 www.youtube.com 2->120 122 7 other IPs or domains 2->122 144 Snort IDS alert for network traffic 2->144 146 Malicious sample detected (through community Yara rule) 2->146 148 Antivirus detection for dropped file 2->148 150 13 other signatures 2->150 12 mxeGE4LCfj.exe 1 4 2->12         started        15 FANBooster131.exe 2->15         started        18 OfficeTrackerNMP131.exe 2->18         started        20 6 other processes 2->20 signatures3 process4 file5 114 2 other malicious files 12->114 dropped 22 Sj6VQ37.exe 1 4 12->22         started        100 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 15->100 dropped 102 C:\...\um8TrcHEHGYX9Sg2O9LYuRzxRJOioomL.zip, Zip 15->102 dropped 178 Multi AV Scanner detection for dropped file 15->178 180 Detected unpacking (changes PE section rights) 15->180 182 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 15->182 196 5 other signatures 15->196 26 WerFault.exe 15->26         started        104 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 18->104 dropped 106 C:\...\5IT6LOTxZiLfUoEkYdDhxWFQh83XKQeH.zip, Zip 18->106 dropped 184 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 18->184 186 Query firmware table information (likely to detect VMs) 18->186 188 Tries to steal Mail credentials (via file / registry access) 18->188 28 WerFault.exe 18->28         started        108 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 20->108 dropped 110 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 20->110 dropped 112 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 20->112 dropped 116 3 other malicious files 20->116 dropped 190 Machine Learning detection for dropped file 20->190 192 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 20->192 194 Queries memory information (via WMI often done to detect virtual machines) 20->194 30 WerFault.exe 20->30         started        32 WerFault.exe 20->32         started        34 WerFault.exe 20->34         started        signatures6 process7 file8 88 C:\Users\user\AppData\Local\...\Dj1Jo74.exe, PE32 22->88 dropped 90 C:\Users\user\AppData\Local\...\6EZ4MC8.exe, PE32 22->90 dropped 156 Antivirus detection for dropped file 22->156 158 Multi AV Scanner detection for dropped file 22->158 160 Machine Learning detection for dropped file 22->160 36 Dj1Jo74.exe 1 4 22->36         started        signatures9 process10 file11 84 C:\Users\user\AppData\Local\...\4At499cJ.exe, PE32 36->84 dropped 86 C:\Users\user\AppData\Local\...\1UX30sv7.exe, PE32 36->86 dropped 152 Multi AV Scanner detection for dropped file 36->152 154 Machine Learning detection for dropped file 36->154 40 4At499cJ.exe 16 41 36->40         started        45 1UX30sv7.exe 12 36->45         started        signatures12 process13 dnsIp14 128 91.92.249.253 THEZONEBG Bulgaria 40->128 130 ipinfo.io 34.117.186.192 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 40->130 92 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 40->92 dropped 94 C:\Users\user\AppData\...\FANBooster131.exe, PE32 40->94 dropped 96 C:\Users\user\AppData\...\MaxLoonaFest131.exe, PE32 40->96 dropped 98 2 other malicious files 40->98 dropped 162 Multi AV Scanner detection for dropped file 40->162 164 Detected unpacking (changes PE section rights) 40->164 166 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 40->166 176 8 other signatures 40->176 47 cmd.exe 40->47         started        50 cmd.exe 40->50         started        52 WerFault.exe 40->52         started        168 Binary is likely a compiled AutoIt script file 45->168 170 Machine Learning detection for dropped file 45->170 172 Found API chain indicative of sandbox detection 45->172 174 Contains functionality to modify clipboard data 45->174 54 chrome.exe 8 45->54         started        57 chrome.exe 45->57         started        59 chrome.exe 45->59         started        61 6 other processes 45->61 file15 signatures16 process17 dnsIp18 198 Uses schtasks.exe or at.exe to add and modify task schedules 47->198 74 2 other processes 47->74 76 2 other processes 50->76 124 192.168.2.5 unknown unknown 54->124 126 239.255.255.250 unknown Reserved 54->126 63 chrome.exe 54->63         started        66 chrome.exe 54->66         started        78 2 other processes 54->78 68 chrome.exe 57->68         started        70 chrome.exe 59->70         started        72 chrome.exe 61->72         started        80 5 other processes 61->80 signatures19 process20 dnsIp21 132 tpop-api.twitter.com 104.244.42.2 TWITTERUS United States 63->132 134 twitter.com 104.244.42.65 TWITTERUS United States 63->134 140 93 other IPs or domains 63->140 82 WerFault.exe 63->82         started        136 31.13.67.35 FACEBOOKUS Ireland 66->136 138 youtube-ui.l.google.com 66->138 142 2 other IPs or domains 66->142 process22
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d11dbe59e05a1104b99aebac58e06bebfd85cf9b269082184cbc67e28f57b2b7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d11dbe59e05a1104b99aebac58e06bebfd85cf9b269082184cbc67e28f57b2b7/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-12-20 16:06:06 UTC
File Type:
PE (Exe)
Extracted files:
176
AV detection:
18 of 22 (81.82%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2eo34wpaliiqjom25owfrydl5p6ylt43e2iiegcmxrt6fd2xwk3q._file
Verdict:
malicious
Similar samples:
380edb414750f511e72ad11116e24b9dc1888350ac13ca6d0cf0bbdc1baec4df
Stealc
850263d1dac582f1d8c9cb585e73b54124ed5c9c58564a89508072b93d73865b
Stealc
862ff11452de99418139941018e044e7802fad311d21ddd396a5476adbe56352
Stealc
8a7cc5239d412feb2e6977e47b1f3ca475fb70172ac200b81ed7700a4097564f
Stealc
+ 2'084 additional samples on MalwareBazaar
Result
Malware family:
zgrat
Create hunting rule
Score:
  10/10
Tags:
family:glupteba family:lumma family:redline family:smokeloader family:stealc family:zgrat botnet:666 botnet:@oleh_ps botnet:livetraffic botnet:up3 backdoor collection discovery dropper evasion infostealer loader persistence rat spyware stealer themida trojan
Link:
https://tria.ge/reports/231220-tj267shgd4/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Enumerates system info in registry
Kills process with taskkill
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Runs net.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Checks for VirtualBox DLLs, possible anti-VM trick
Drops file in Program Files directory
Launches sc.exe
AutoIT Executable
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Modifies Windows Firewall
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Stealc
ZGRat
Detect Lumma Stealer payload V4
Detect ZGRat V1
Glupteba
Glupteba payload
Lumma Stealer
RedLine
RedLine payload
SmokeLoader
Malware Config
C2 Extraction:
http://185.215.113.68/fks/index.php
195.20.16.103:18305
176.123.7.190:32927
http://host-file-host6.com/
http://host-host-file8.com/
http://77.91.76.36
77.105.132.87:17066
Unpacked files
SH256 hash:
6851e02d3f4b8179b975f00bbc86602a2f2f84524f548876eb656db7ea5eaa9c
MD5 hash:
c5124caf4aea3a83b63a9108fe0dcef8
SHA1 hash:
a43a5a59038fca5a63fa526277f241f855177ce6
Link:
https://www.unpac.me/results/79c8ca91-d33b-4799-868d-ed790a341f40/
SH256 hash:
28f277ec49c79e276c22af822a5aa6928ae231748ce975ff202a3b56bf68b2fe
MD5 hash:
794f17011bd40dfa99b2cf336b6851b2
SHA1 hash:
fbf077781961ac42f045fd3ac98d076f56eed9e2
Detections:
AutoIT_Compiled
Create hunting rule
Link:
https://www.unpac.me/results/79c8ca91-d33b-4799-868d-ed790a341f40/
SH256 hash:
d11dbe59e05a1104b99aebac58e06bebfd85cf9b269082184cbc67e28f57b2b7
MD5 hash:
817d4a2631ba6ee72587b33a850901e8
SHA1 hash:
115c36b09447dfc618bd5d6a53fae9058027c23a
Detections:
win_redline_wextract_hunting_oct_2023
Create hunting rule
Link:
https://www.unpac.me/results/79c8ca91-d33b-4799-868d-ed790a341f40/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d11dbe59e05a1104b99aebac58e06bebfd85cf9b269082184cbc67e28f57b2b7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe d11dbe59e05a1104b99aebac58e06bebfd85cf9b269082184cbc67e28f57b2b7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2738241/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/468640/

Comments