MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e08a7ed1e201f5564f8ec101f6f5faff7b93f3d72e340e707e0d4bead84ebe2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 15

Intelligence 15 IOCs YARA 4 File information Comments

SHA256 hash:	e08a7ed1e201f5564f8ec101f6f5faff7b93f3d72e340e707e0d4bead84ebe2b
SHA3-384 hash:	1b4901d8512c38ef29555a54e0bc94ce45ca2e94ca39adf7311d327eb840208667f10e8afd4ba55ce3ff422d51ecede9
SHA1 hash:	136b229c49ef4d359c0ae7f11baacbee94051787
MD5 hash:	1c5c089ba5b20bdd4b9c0effa0f3d7b9
humanhash:	maryland-april-oscar-speaker
File name:	G4gtDRI.exe
Download:	download sample
Signature	Stealc Create hunting rule
File size:	2'214'400 bytes
First seen:	2025-08-09 01:35:55 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	75a20672afc7bfa2e72f3631474db75d (4 x LummaStealer, 2 x Stealc, 2 x Vidar)
ssdeep	24576:96UzgkEo0Vqd4FRdErURSRlLTLobO/lESxAxqYiiym5voVyHIfrZm3kiatEuIUft:962gkn0Vqu0URA5ie7YqadoVyHINraq1
TLSH	T13FA5D025E87891DAFDD301B17B599252A4337F3BDE2C669B40B48B40124AEED163F13B
TrID	63.5% (.EXE) Win64 Executable (generic) (10522/11/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	aachum
Tags:	exe LabInstalls LogsDiller Stealc

iamaachum

http://45.141.233.196/files/5296057416/G4gtDRI.exe

Stealc Botnet: LogsDillerCloud
Stealc C2: http://closeddoors.shop/45cc90de006049c9.php

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

redline

ID:

File name:

A715971E33269C09F9F214C90752B123.exe

Verdict:

Malicious activity

Analysis date:

2025-08-09 00:10:21 UTC

Tags:

auto redline stealer amadey lumma botnet loader auto-reg rdp lefthook teapotstealer auto-startup autoit themida rhadamanthys stealc purecrypter qrcode github telegram gcleaner exfiltration purelogs vidar

Link:

https://app.any.run/tasks/ba07757b-671b-44ee-b431-52ae239f27ef

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/19805/

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6896a6221e8a59ee04e7bc9b

Tags:

virus krypt

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Сreating synchronization primitives

Connection attempt to an infection source

Sending an HTTP POST request to an infection source

Creating a window

Query of malicious DNS domain

Unauthorized injection to a system process

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/e08a7ed1e201f5564f8ec101f6f5faff7b93f3d72e340e707e0d4bead84ebe2b

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/b619c556-3800-4950-9be5-c77b52615ff1

Result

Threat name:

Stealc v2

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1753489

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found malware configuration

Injects a PE file into a foreign processes

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Sigma detected: Silenttrinity Stager Msbuild Activity

Writes to foreign memory regions

Yara detected Stealc v2

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/e08a7ed1e201f5564f8ec101f6f5faff7b93f3d72e340e707e0d4bead84ebe2b

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 64 Exe x64

Link:

https://app.malva.re/file/1c5c089ba5b20bdd4b9c0effa0f3d7b9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e08a7ed1e201f5564f8ec101f6f5faff7b93f3d72e340e707e0d4bead84ebe2b/

Verdict:

Malicious

Threat:

Family.STEALC

Link:

https://tip.neiki.dev/file/e08a7ed1e201f5564f8ec101f6f5faff7b93f3d72e340e707e0d4bead84ebe2b

Threat name:

Win64.Trojan.Amadey

Status:

Suspicious

First seen:

2025-08-08 12:14:28 UTC

File Type:

PE+ (Exe)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4cfh5upcah2vmt4oyea7n5p2755zh46xfy2a44d6bvf6vwcoxyvq._file

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc botnet:logsdillercloud discovery stealer

Link:

https://tria.ge/reports/250809-b1hvsa1shz/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Stealc

Stealc family

Malware Config

C2 Extraction:

http://closeddoors.shop

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/fe001e95-8d9e-4520-af08-3cd792c134ca

Unpacked files

SH256 hash:

e08a7ed1e201f5564f8ec101f6f5faff7b93f3d72e340e707e0d4bead84ebe2b

MD5 hash:

1c5c089ba5b20bdd4b9c0effa0f3d7b9

SHA1 hash:

136b229c49ef4d359c0ae7f11baacbee94051787

Link:

https://www.unpac.me/results/783a4f01-0d2f-42ee-889f-fdaf334df515/

Malware family:

Stealc

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e08a7ed1e201/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e08a7ed1e201f5564f8ec101f6f5faff7b93f3d72e340e707e0d4bead84ebe2b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe e08a7ed1e201f5564f8ec101f6f5faff7b93f3d72e340e707e0d4bead84ebe2b

(this sample)

Link

https://tria.ge/250809-brqh9swkz8/behavioral1

Dropped by

Amadey

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3594031/

Cape

https://www.capesandbox.com/analysis/19805/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW
WIN_USER_API	Performs GUI Actions	USER32.dll::EmptyClipboard USER32.dll::OpenClipboard USER32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample