MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df6df345690b11a2fa15db713d36614a603af22e68d8b85bd7b663aaa48bf48e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 18

Intelligence 18 IOCs 2 YARA 2 File information Comments

SHA256 hash:	df6df345690b11a2fa15db713d36614a603af22e68d8b85bd7b663aaa48bf48e
SHA3-384 hash:	92a26b9a3fc6efd25ca4abbcb0f35a23f629edf1375b2e5c4fd4705b8f2db99439b27c169dddf39ff471678ccc8c59f1
SHA1 hash:	2620bd91d73cd7d7e80423bcf079015894d35198
MD5 hash:	aa255022717ce2fe7d6cb096ef91d15e
humanhash:	stream-ink-stream-yellow
File name:	aa255022717ce2fe7d6cb096ef91d15e.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	442'368 bytes
First seen:	2024-10-19 09:10:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	624d8cd650399fa54fccfe2a064c30bd (1 x Stealc)
ssdeep	6144:vQ1LNkCIHFTmSsQqDRoUyczDz5UsF/jUmxb56N1wmYG1lD/7sFj:Y1xIHIXydsNo+lGl
TLSH	T19494CF22DFE2EE51DA164A714D1EE7E8352DF9509E44776F2E18AA2F28703B1C123335
TrID	46.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 25.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 8.5% (.EXE) Win64 Executable (generic) (10522/11/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
File icon (PE):
dhash icon	0305030514311100 (1 x Stealc)
Reporter	abuse_ch
Tags:	exe Stealc

abuse_ch

Stealc C2:
185.208.158.202:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
185.208.158.202:80	https://threatfox.abuse.ch/ioc/1337482/
http://45.88.76.205/951cb8efb87ef43a.php	https://threatfox.abuse.ch/ioc/1338041/

Intelligence

File Origin

# of uploads :

# of downloads :

403

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

aa255022717ce2fe7d6cb096ef91d15e.exe

Verdict:

Malicious activity

Analysis date:

2024-10-19 09:11:53 UTC

Tags:

loader smokeloader

Link:

https://app.any.run/tasks/72bf0451-4ffc-415e-a257-f6c7e68d517b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=671377a834f884d15c8d05ed

Tags:

Phishing Hype Onli

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Query of malicious DNS domain

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

fingerprint microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/671377a8d875ce8b57d5c6f6/reports/c0d04723-911b-4e9c-ae39-264d4fe9da00/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/df6df345690b11a2fa15db713d36614a603af22e68d8b85bd7b663aaa48bf48e

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d2aee47b-783b-4563-b136-c15ba6f1e761

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1537624

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/df6df345690b11a2fa15db713d36614a603af22e68d8b85bd7b663aaa48bf48e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/df6df345690b11a2fa15db713d36614a603af22e68d8b85bd7b663aaa48bf48e/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2024-10-19 09:11:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=35w7grljbmi2f6qv3nyt2ntbjjqdv4rondmlqw6xwzr2vjel6sha._file

Verdict:

malicious

Label(s):

shellcode_loader_002

Similar samples:

error

Stealc

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:pub1 backdoor discovery trojan

Link:

https://tria.ge/reports/241019-k5la5sxhrb/

Behaviour

Checks SCSI registry key(s)

Program crash

System Location Discovery: System Language Discovery

SmokeLoader

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/3ab5b59d-eac7-4780-b3db-da9ae3669199

Unpacked files

SH256 hash:

aaf66610fa41dbdb7274c274954d697a0e81e83e677bf3b58102222c291b6949

MD5 hash:

2577ec6102eea4a1af020833990069fc

SHA1 hash:

7aa9cfbe30c72c855887931ed217e576dc70b284

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/ee36f298-4877-4969-9bc4-55509d77ff04/

Parent samples :

5d2e0f8cc9eb2b09f11c0e90303eafd9bf4593426cdc0bc649e074a1ad913247
75710e4a218440b1e9e330f231cfca45d5f7c41eacf9a7bd45bfd06042b79eac
71e552270361997f7b42b4ffa227ebd6a791948bfed757e61f2c3c7390bacaa3
0cf8ad6b4b1a25137fb42e0d831386e514620c851f782e37ebbd0d68105eb3d1
c4139579bd2c09fa3f876c15b04be33bd25e5c524fb687557771a07e99e22b9c
af1cd06ae9d17e6d05909d5031a72788989cb3980e7a456011091fc3ac77a07f
62469fe28764545471f447f88db812a162e9fe0af09f93b343c192a306600743
27ef27b61120a709590570f7fa86aa018f2e9b143bf97c4734720d2096b0bdf6
df6df345690b11a2fa15db713d36614a603af22e68d8b85bd7b663aaa48bf48e
2cfc6fe46f2025a7aeab3dbb5d271c49cb3341545313582ab6603351e75ee19c

SH256 hash:

df6df345690b11a2fa15db713d36614a603af22e68d8b85bd7b663aaa48bf48e

MD5 hash:

aa255022717ce2fe7d6cb096ef91d15e

SHA1 hash:

2620bd91d73cd7d7e80423bcf079015894d35198

Link:

https://www.unpac.me/results/ee36f298-4877-4969-9bc4-55509d77ff04/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/df6df345690b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/df6df345690b11a2fa15db713d36614a603af22e68d8b85bd7b663aaa48bf48e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe df6df345690b11a2fa15db713d36614a603af22e68d8b85bd7b663aaa48bf48e

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3192422/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetDiskFreeSpaceExA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::ReadConsoleInputA KERNEL32.dll::GetConsoleAliasExesA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::GetFileAttributesW KERNEL32.dll::GetTempFileNameA KERNEL32.dll::SetVolumeMountPointA
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameA
WIN_HTTP_API	Uses HTTP services	WINHTTP.dll::WinHttpOpen

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample