MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d55ad94a77ea66d10c117f375fa1aa86878c4801d95e1e89af06a540a1a447c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 16

Intelligence 16 IOCs YARA 4 File information Comments 1

SHA256 hash:	d55ad94a77ea66d10c117f375fa1aa86878c4801d95e1e89af06a540a1a447c2
SHA3-384 hash:	407b6f0d5b2262b10cbf22d6df3a11bc6446d11ac277689bb4811d0eab27de17d7fc683e988f6c8b2d44211b67a56bde
SHA1 hash:	d9d1bacd966984882644595ca7542e0c3d67fa91
MD5 hash:	4ec10535a0c83d9f310225e3ee7b25a4
humanhash:	early-may-gee-social
File name:	4ec10535a0c83d9f310225e3ee7b25a4
Download:	download sample
Signature	Stealc Create hunting rule
File size:	420'352 bytes
First seen:	2024-10-30 04:13:16 UTC
Last seen:	2024-10-30 06:17:50 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	badfb6fadfeccc7ec69f82ecbeac88f5 (2 x Stealc)
ssdeep	6144:f+EGZYx3sGHk92NHNMroijaVNMvYmflOY3Grv4C/ufK:mbGHk92Nar9jgsYmfgYBR
Threatray	365 similar samples on MalwareBazaar
TLSH	T17B94D00176F68536F3F38A706875B7E41E7BF8936931918E2254A7AE4E323C18972713
TrID	67.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 12.2% (.EXE) Win64 Executable (generic) (10522/11/4) 5.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.2% (.EXE) Win32 Executable (generic) (4504/4/1) 2.4% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
File icon (PE):
dhash icon	ccc6c30a0e4c8a94 (1 x Stealc, 1 x LummaStealer)
Reporter	zbetcheckin
Tags:	32 exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

436

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

4ec10535a0c83d9f310225e3ee7b25a4

Verdict:

Malicious activity

Analysis date:

2024-10-30 04:16:12 UTC

Tags:

loader stealer stealc

Link:

https://app.any.run/tasks/440eec99-7462-4504-9b0a-f414ab02917e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.29359.5673.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6721b28f49e92a05dde1d1af

Tags:

exploit cobalt extens agent

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Sending an HTTP GET request

Creating a window

Sending an HTTP GET request to an infection source

Creating a file in the %temp% directory

Creating a process from a recently created file

Launching the default Windows debugger (dwwin.exe)

Connection attempt to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc packed packed packer_detected

Link:

https://www.filescan.io/uploads/6721b28aae830d48b5dc12ee/reports/36fa1eb1-7e03-4988-ac86-85c58f6a26c0/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/d55ad94a77ea66d10c117f375fa1aa86878c4801d95e1e89af06a540a1a447c2

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/cde44477-ea1e-42f9-bc9c-7416e72f2071

Result

Threat name:

Stealc

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1545095

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Searches for specific processes (likely to inject)

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d55ad94a77ea66d10c117f375fa1aa86878c4801d95e1e89af06a540a1a447c2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d55ad94a77ea66d10c117f375fa1aa86878c4801d95e1e89af06a540a1a447c2/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2024-10-30 04:14:05 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2vnnsstx5jtncdarp43v7inkq2dyysab3fpb5cnpa2subinei7ba._file

Verdict:

malicious

Label(s):

stealc

shellcode_loader_002

Stealc

2cef6d9917bbccdc5ffffbf7b687da70e673f3a5dc6923c715e4fc50e0115e17

Stealc

4f363d41d1e54162264275eb262685aa6508af2edfb2af7a1b1b95034ffa63ee

Stealc

57742d6edf5ffc0fd65d91e1520f96115eb63765406a50a69cd65116da2cfd77

Stealc

6b23abaea95768da8ce9fc5be1df50971eba79d76a53b7ad8cf62386be4ae8aa

Stealc

error

Stealc

+ 355 additional samples on MalwareBazaar

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc botnet:default9_cap discovery stealer

Link:

https://tria.ge/reports/241030-etmryawepd/

Behaviour

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Downloads MZ/PE file

Stealc

Stealc family

Malware Config

C2 Extraction:

http://62.204.41.177

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/f5175d5d-8af4-4eb7-92d2-aa6f60e8ec11

Unpacked files

SH256 hash:

2f841285068467a1b17875763849bd7d0fd88f732351cd2ce9f000239fbdc34c

MD5 hash:

8855493f8be066bd5b5aa6804925b674

SHA1 hash:

948ff7c8832b5d27c6dd9268004aa46f4f21b69e

Link:

https://www.unpac.me/results/b564faec-701e-4c03-9334-0012bb4f8194/

SH256 hash:

d55ad94a77ea66d10c117f375fa1aa86878c4801d95e1e89af06a540a1a447c2

MD5 hash:

4ec10535a0c83d9f310225e3ee7b25a4

SHA1 hash:

d9d1bacd966984882644595ca7542e0c3d67fa91

Link:

https://www.unpac.me/results/b564faec-701e-4c03-9334-0012bb4f8194/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d55ad94a77ea/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d55ad94a77ea66d10c117f375fa1aa86878c4801d95e1e89af06a540a1a447c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe d55ad94a77ea66d10c117f375fa1aa86878c4801d95e1e89af06a540a1a447c2

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3224762/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::VirtualAllocEx KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::DeleteVolumeMountPointW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::WriteConsoleA KERNEL32.dll::ReadConsoleOutputCharacterW KERNEL32.dll::SetConsoleCursorPosition KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleAliasExesLengthW KERNEL32.dll::GetConsoleAliasW KERNEL32.dll::GetConsoleFontSize KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA KERNEL32.dll::MoveFileExW KERNEL32.dll::MoveFileA KERNEL32.dll::GetFileAttributesA KERNEL32.dll::GetSystemWow64DirectoryW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-10-30 04:13:17 UTC

url : hxxp://176.113.115.37/InstallSetup.exe