MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683
SHA3-384 hash:	f673548f6af0d94269cb7253f1aceadf817dc28003104f39638e1aa4359e515b4fb589b08d935dd1b86bfef95c1bffcb
SHA1 hash:	44c1879d60cf4a6d4202114aa8798a2ed0e0e8cc
MD5 hash:	e13c92058e609717d68810d4f1773af9
humanhash:	solar-montana-failed-stairway
File name:	syncUpd.exe
Download:	download sample
Signature	Stealc Alert Create hunting rule
File size:	249'344 bytes
First seen:	2023-12-21 05:22:36 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9138bad961b0c12306fd188b3eb186f0 (1 x LummaStealer, 1 x Stop, 1 x Stealc)
ssdeep	6144:8gDYLdO9xoBEyPXVHu1vj/S9Kz1cfCSj:8VZ2xsFHIvjK98ufJ
TLSH	T1DE342A2392F07D95FA66CB728E2ECAE8769EF5508F0977A712189A1F04B11F2C173711
TrID	34.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 25.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 18.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 6.3% (.EXE) Win64 Executable (generic) (10523/12/4) 3.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):
dhash icon	040406052c083000 (1 x Stealc)
Reporter	adm1n_usa32
Tags:	exe Stealc

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

322

Origin country :

RO

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/468734/

ClamAV Detected

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Reading critical registry keys

Sending a custom TCP request

Changing a file

Creating a file in the %AppData% subdirectories

Creating a window

Running batch commands

Creating a process with a hidden window

Launching a process

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Stealing user critical data

Sending an HTTP GET request to an infection source

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6583cbb6f4b6e5e16352e95e/reports/ffa43c93-501f-4f31-adfe-5df3586a414b/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Stealc

Malware family:

Stealc

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2394c097-093f-459e-aa59-ed3ccce856dc

Joe Sandbox Stealc, Vidar

Result

Threat name:

Stealc, Vidar

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1365431

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Overwrites Mozilla Firefox settings

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683

CERT.PL MWDB stealc

Detection:

stealc

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-21 05:23:05 UTC

File Type:

PE (Exe)

Extracted files:

41

AV detection:

18 of 23 (78.26%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4hdmb6fjjhp64ohl6uat5mtlkls3wu7hyeh4libfk4rqkvixi2bq._file

Threatray malicious

Verdict:

malicious

Hatching Triage stealc

Result

Malware family:

stealc

Alert

Create hunting rule

Score:

  10/10

Tags:

family:stealc discovery spyware stealer

Link:

https://tria.ge/reports/231221-f25s6afghk/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Deletes itself

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Stealc

Malware Config

C2 Extraction:

http://77.91.76.36

UnpacMe stealc win_stealc_auto win_stealc_a0 win_stealc_bytecodes_oct_2023

Unpacked files

SH256 hash:

7fdbfde21e6a9f34966dcbf2c4f008f7c13a52385852aad40e0485c23ec6b614

MD5 hash:

fadec2f496629ad87cfbb9a2a7f5446d

SHA1 hash:

da783e5c9568589655760aea863def2b5df5342a

Detections:

stealc

Alert

Create hunting rule

win_stealc_auto

Alert

Create hunting rule

win_stealc_a0

Alert

Create hunting rule

win_stealc_bytecodes_oct_2023

Alert

Create hunting rule

Link:

https://www.unpac.me/results/cea3e19d-5a10-4595-b7b0-91560df6a443/

Parent samples :

e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683
7eda35b2c10d5bbc286d3f446c142758783aea0535b55c9dd42968d35ca202fa
fa6ba41bff46096cf24102217650b7a3190a5b7ae13f0c69c96bb38f726014f5
81628e4300b6cebde33d6cfbee5f483d230216616b812e6896aa159d77b0c081
bbc7dd5d471b06ed6e6f3ee03bef18e6967cf244bbc1ede6af795de22aaad6a9

SH256 hash:

e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683

MD5 hash:

e13c92058e609717d68810d4f1773af9

SHA1 hash:

44c1879d60cf4a6d4202114aa8798a2ed0e0e8cc

Link:

https://www.unpac.me/results/cea3e19d-5a10-4595-b7b0-91560df6a443/

VMRay Stealc

Malware family:

Stealc

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e1c6c0f8a949/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

exe e1c6c0f8a949dfee38ebf5013eb26b52e5bb53e7c10fc5a02557230555174683

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2736472/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/468734/