MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd270d00f3c4abb201f6f36e5440badf4b0dfa1eda4ead4d7e4907c370607fbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 16

Intelligence 16 IOCs YARA 11 File information Comments

SHA256 hash:	dd270d00f3c4abb201f6f36e5440badf4b0dfa1eda4ead4d7e4907c370607fbf
SHA3-384 hash:	57725ba8258757b5d597739c2c8f0923970c28a9b4cd7ae59cf9d4b6fbcc36924db4a029fe45e7aa61e0420c49a2d180
SHA1 hash:	d7f3c1468fa22a14f6b748725eacc137e0077125
MD5 hash:	e06f68cd2ddc7545c72b824eb09652e6
humanhash:	tango-bulldog-summer-cat
File name:	salsa.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	634'880 bytes
First seen:	2026-11-01 11:32:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	a1fa2d08960884e06f2dc59bd5f7a43c (7 x Stealc)
ssdeep	6144:X9it9aiPoI7HlVHCCUjRr8WZ3hoYKvO7UTeGqm/Tl0NyCZeZGwHmPWs274GxiK0h:X9Ry18CUtr8WZxoFqevmOl4uiK0
TLSH	T12FD47C56EBA402F8D17BC1B4CA828957EB76B855433065CB03E24A675F376A05F3EF20
TrID	37.0% (.EXE) Win64 Executable (generic) (6522/11/2) 28.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.5% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3) 11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	abuse_ch
Tags:	exe Stealc

Intelligence

File Origin

# of uploads :

# of downloads :

189

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-01 11:49:33 UTC

Tags:

stealc stealer

Link:

https://app.any.run/tasks/8010f48d-f893-43aa-8ea1-7520ca27e487

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/96520/

Detection(s):

Win.Malware.Generickdz-10058619-0

YARA.CAPE_Stealcv2Datecheck.UNOFFICIAL

YARA.RUSSIANPANDA_Win_Mal_Chromium_App_Bound_Encryption_Decrypter.UNOFFICIAL

YARA.RUSSIANPANDA_Win_Mal_Stealc_V2.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae7234fb175ade21dcee480

Tags:

shellcode virus crypt

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating synchronization primitives

Connection attempt

Sending an HTTP POST request

Gathering data

Verdict:

Malicious

Labled as:

Midie.Generic

Link:

https://www.hybrid-analysis.com/sample/dd270d00f3c4abb201f6f36e5440badf4b0dfa1eda4ead4d7e4907c370607fbf

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-11-01T04:55:00Z UTC

Last seen:

2026-11-02T19:56:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/dd270d00f3c4abb201f6f36e5440badf4b0dfa1eda4ead4d7e4907c370607fbf/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/64ed5fd5-b6a0-4abf-bcfb-ec29cdadc623

Result

Threat name:

Stealc

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1996093

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Early bird code injection technique detected

Found API chain indicative of debugger detection

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Queues an APC in another process (thread injection)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Stealc

Yara detected Stealc v2

Behaviour

Behavior Graph:

Download SVG

Score:

97%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/dd270d00f3c4abb201f6f36e5440badf4b0dfa1eda4ead4d7e4907c370607fbf

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/e06f68cd2ddc7545c72b824eb09652e6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dd270d00f3c4abb201f6f36e5440badf4b0dfa1eda4ead4d7e4907c370607fbf/

Threat name:

Win64.Trojan.Stealc

Status:

Malicious

First seen:

2026-11-01 09:26:43 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

19 of 23 (82.61%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3utq2ahtysv3eapw6nxfiqf235fq36q63jhk2tl6jed4g4dap67q._file

Verdict:

malicious

Label(s):

StealC

Link:

https://reports.threatray.com/db04c4db-8ff9-4856-812a-3b9c235fb6cb

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/261101-nnfwwavsaz/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Reads the TCP/IP host and domain name from the registry

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Malware Family:

n/a

Verdict:

Suspicious

Tags:

rat

YARA:

BrowserStealer

Link:

https://app.threat.zone/submission/0c39ff98-76e6-4a66-8cef-e2c76830d25f

Malware Family:

stealc

Malicious:

True

Tags:

64bits

Link:

https://intel.virussign.com/intelligence/file/dd270d00f3c4abb201f6f36e5440badf4b0dfa1eda4ead4d7e4907c370607fbf

Unpacked files

SH256 hash:

dd270d00f3c4abb201f6f36e5440badf4b0dfa1eda4ead4d7e4907c370607fbf

MD5 hash:

e06f68cd2ddc7545c72b824eb09652e6

SHA1 hash:

d7f3c1468fa22a14f6b748725eacc137e0077125

Link:

https://www.unpac.me/results/ce28ff53-b707-4bae-901f-9a8742622f2b/

SH256 hash:

c4d37b20005b55afce3748337a35dfebc31dd8a06c808849a6c5e74e6b25d03b

MD5 hash:

e26ee32fefe1cfca2ec8bd0bfc7d4c71

SHA1 hash:

0ed361a7118ce2d755a34f368718593ea91eb2d0

Link:

https://www.unpac.me/results/ce28ff53-b707-4bae-901f-9a8742622f2b/

Malware family:

Stealc.v2

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/dd270d00f3c4/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dd270d00f3c4abb201f6f36e5440badf4b0dfa1eda4ead4d7e4907c370607fbf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	StealcV2DateCheck Create hunting rule
Author:	kevoreilly
Description:	StealcV2 date check bypass

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.