MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0d3f516439acf14a09cf9fcf23537b4b9ea20b185e35a319c217d344d449993. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0d3f516439acf14a09cf9fcf23537b4b9ea20b185e35a319c217d344d449993
SHA3-384 hash: 3a062c3682a6117aad7fc709e6e6e5fa6f32f2682efaa3fc8e4940bbd925b8b038045d79322d6bd35391f935f3a8e76c
SHA1 hash: fe3bafddd4ce1e7b1b84f00c06c6be083eb3f2a3
MD5 hash: 99cb1a9faad6fb1984d4fffca314e8af
humanhash: spring-louisiana-south-winter
File name:i8kSMr9.exe
Download: download sample
Signature Stealc
Create hunting rule
File size:1'878'016 bytes
First seen:2025-07-16 07:15:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f5f30b7b5f259a4a0b7809ee71919fa8 (2 x Stealc, 2 x LummaStealer, 2 x CoinMiner)
ssdeep 24576:NPHgeez3kDAnbS4WsY81mUJO65HNdf+WevY81mUJO65HNdf+WeU:NPAIAnXWTOmqXpewOmqXpeU
TLSH T1B095E03A9A95F2C7FD7600B6405225947833B537C22A6FFB9294D273AF136C05B19B2C
TrID 63.5% (.EXE) Win64 Executable (generic) (10522/11/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter abuse_ch
Tags:exe Stealc

Intelligence

File Origin
# of uploads :
1
# of downloads :
32
Origin country :
SE SE
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
c9079b11a3f48bc433e4cbf3a8db58339a3b6c400f55268ca91ac53afec9e136.bin.exe
Verdict:
Malicious activity
Analysis date:
2025-07-16 02:02:33 UTC
Tags:
lumma stealer themida loader amadey botnet stealc rdp auto generic aurotun netreactor purehvnc hijackloader delphi ultravnc rmm-tool evasion rustystealer telegram websocket pastebin vidar
Link:
https://app.any.run/tasks/f4156d88-487b-4367-988b-45cda04f5221

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/14799/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=687751be7854bfe261a3f531
Tags:
n/a
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Creating a window
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP POST request
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypt fingerprint microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/687751de5076b202e43da406/reports/a2bd2ceb-5662-4358-ba14-a021b3e7ad25/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/e0d3f516439acf14a09cf9fcf23537b4b9ea20b185e35a319c217d344d449993
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e664eb8e-566a-4c35-9a6a-4b5b73229bbf
Result
Threat name:
Stealc v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1737862
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for dropped file
Found direct / indirect Syscall (likely to bypass EDR)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Silenttrinity Stager Msbuild Activity
Switches to a custom stack to bypass stack traces
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1737862 Sample: i8kSMr9.exe Startdate: 16/07/2025 Architecture: WINDOWS Score: 100 46 prolprolprol.shop 2->46 48 lomejordesalamanca.es 2->48 64 Antivirus detection for dropped file 2->64 66 Multi AV Scanner detection for dropped file 2->66 68 Multi AV Scanner detection for submitted file 2->68 70 5 other signatures 2->70 10 i8kSMr9.exe 2->10         started        13 elevation_service.exe 2->13         started        signatures3 process4 signatures5 80 Writes to foreign memory regions 10->80 82 Allocates memory in foreign processes 10->82 84 Injects a PE file into a foreign processes 10->84 15 MSBuild.exe 23 10->15         started        20 MSBuild.exe 10->20         started        process6 dnsIp7 50 prolprolprol.shop 87.120.126.216, 49718, 49723, 49738 UNACS-AS-BG8000BurgasBG Bulgaria 15->50 52 lomejordesalamanca.es 188.164.198.15, 49739, 80 INFORTELECOM-ASES Spain 15->52 42 C:\Users\user\AppData\...\Rq5FUtxZIkTP.exe, PE32+ 15->42 dropped 44 C:\Users\user\AppData\...\chrome_134[1].exe, PE32+ 15->44 dropped 54 Found many strings related to Crypto-Wallets (likely being stolen) 15->54 56 Tries to harvest and steal browser information (history, passwords, etc) 15->56 58 Writes to foreign memory regions 15->58 62 4 other signatures 15->62 22 Rq5FUtxZIkTP.exe 15->22         started        25 msedge.exe 15->25         started        27 msedge.exe 15->27         started        29 5 other processes 15->29 60 Switches to a custom stack to bypass stack traces 20->60 file8 signatures9 process10 signatures11 72 Antivirus detection for dropped file 22->72 74 Multi AV Scanner detection for dropped file 22->74 76 Query firmware table information (likely to detect VMs) 22->76 78 6 other signatures 22->78 31 powershell.exe 23 22->31         started        34 WerFault.exe 16 25->34         started        36 WerFault.exe 1 16 27->36         started        38 WerFault.exe 16 29->38         started        process12 signatures13 86 Loading BitLocker PowerShell Module 31->86 40 conhost.exe 31->40         started        process14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e0d3f516439acf14a09cf9fcf23537b4b9ea20b185e35a319c217d344d449993
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 64 Exe x64
Link:
https://app.malva.re/file/99cb1a9faad6fb1984d4fffca314e8af
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0d3f516439acf14a09cf9fcf23537b4b9ea20b185e35a319c217d344d449993/
Threat name:
Win64.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2025-07-16 01:00:19 UTC
File Type:
PE+ (Exe)
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4dj7kfsdtlhrjie47h6penjxws46uifrqxrvumm4ef6titketgjq._file
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:logsdillercloud discovery stealer
Link:
https://tria.ge/reports/250716-h3v2fs1ms5/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Suspicious use of SetThreadContext
Stealc
Stealc family
Malware Config
C2 Extraction:
http://prolprolprol.shop
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/dca514c6-2967-498d-b1ee-60009b976f67
Unpacked files
SH256 hash:
e0d3f516439acf14a09cf9fcf23537b4b9ea20b185e35a319c217d344d449993
MD5 hash:
99cb1a9faad6fb1984d4fffca314e8af
SHA1 hash:
fe3bafddd4ce1e7b1b84f00c06c6be083eb3f2a3
Link:
https://www.unpac.me/results/3f0403cf-cf7e-48c7-9c07-c14d77921269/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e0d3f516439acf14a09cf9fcf23537b4b9ea20b185e35a319c217d344d449993

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe e0d3f516439acf14a09cf9fcf23537b4b9ea20b185e35a319c217d344d449993

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3578896/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/14799/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetCommandLineA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::FreeConsole
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleMode
KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::CreateWindowExW

Comments