MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e262b9a154e7330909bb38672ac039c4e38180b2f9df35931e306361e738cde4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 10

Intelligence 10 IOCs YARA 17 File information Comments

SHA256 hash:	e262b9a154e7330909bb38672ac039c4e38180b2f9df35931e306361e738cde4
SHA3-384 hash:	c338619829fec57baea332164cee0235550e7abe7f63e55c6936cb0bcfd5bcc8919a1cd9e667052e41fb10044e2feb3a
SHA1 hash:	c82bb1544303a4a33195be9873ec4ee241859be9
MD5 hash:	80a47ea2e29bce4d1d0e0e298a1e40c5
humanhash:	bakerloo-wyoming-spaghetti-ten
File name:	Fimorex_launcher.zip
Download:	download sample
Signature	Stealc Create hunting rule
File size:	1'825'713 bytes
First seen:	2025-11-28 12:45:32 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24576:k5RiN5KuH0vQLLcQbdAokKXUMb21nE08Sc6ApG1cF:kRB3v+zdAokKEC0WSqI1u
TLSH	T19D853587CAC61DC6DDC518386D7B4F704A71C8AAF816CA138B32A6AD9FD7794CC1A04D
Magika	zip
Reporter	burger
Tags:	file-pumped Stealc zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Fimorex_launcher.exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	896'532'480 bytes
SHA256 hash:	b2131951b56397080c66a51105b2a2e881eec2035b7e1bec6003d58aaf5fbf07
MD5 hash:	9f5a7b990617adb5c8cf554868329b84
De-pumped file size:	937'984 bytes (Vs. original size of 896'532'480 bytes)
De-pumped SHA256 hash:	fc1b1c4298fed6fb443a9cf32c7ce29c44f3e01b037511962e9fa87324e98a3d
De-pumped MD5 hash:	2b29925dce16c84535a9c8ef590d63eb
MIME type:	application/x-dosexec
Signature	Stealc

Vendor Threat Intelligence

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=692999a76cb1dcd57781f463

Tags:

n/a

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/e262b9a154e7330909bb38672ac039c4e38180b2f9df35931e306361e738cde4/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e262b9a154e7330909bb38672ac039c4e38180b2f9df35931e306361e738cde4

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/e262b9a154e7330909bb38672ac039c4e38180b2f9df35931e306361e738cde4

Verdict:

Clean

File Type:

zip

Link:

https://opentip.kaspersky.com/e262b9a154e7330909bb38672ac039c4e38180b2f9df35931e306361e738cde4/results?tab=lookup

Score:

98%

Verdict:

Malware

File Type:

Result

Malware family:

stealc

Score:

10/10

Tags:

family:stealc botnet:6a9q970dk54lk18mbm defense_evasion discovery execution persistence spyware stealer trojan

Link:

https://tria.ge/reports/251128-qep5as1qft/

Behaviour

Checks processor information in registry

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Time Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Executes dropped EXE

Reads user/profile data of web browsers

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Stealc

Stealc family

Windows security bypass

Malware Config

C2 Extraction:

https://ggh5e4h54.cc

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/e262b9a154e7330909bb38672ac039c4e38180b2f9df35931e306361e738cde4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Heuristics_ChromeABE Create hunting rule
Author:	Still
Description:	attempts to match instructions related to Chrome App-bound Encryption elevation service; possibly spotted amongst infostealers

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PK_PUMP_AND_DUMP Create hunting rule
Author:	Will Metcalf @node5
Description:	Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	StealcV2 Create hunting rule
Author:	Still
Description:	attempts to match the instructions found in StealcV2

Rule name:	sus_pe_free_without_allocation Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects an executable importing functions to free memory without importing allocation functions, often indicative of dynamic import resolution

Rule name:	weird_zip_high_compression_ratio Create hunting rule
Author:	Maxime THIEBAUT (@0xThiebaut)
Description:	Detects single-entry ZIP files with a suspiciously high compression ratio (>100:1) and decompressed size above the 500MB AV limit
Reference:	https://twitter.com/Cryptolaemus1/status/1633099154623803394