MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e26d7dabcf5095750d11407a9341af6c898034b75f9fff158cc4c4757ec9f51a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Stealc


Vendor detections: 19


Intelligence 19 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e26d7dabcf5095750d11407a9341af6c898034b75f9fff158cc4c4757ec9f51a
SHA3-384 hash: 546289343a58dbe771a3699607c43d3e97e486b839e409a3367503c54dbbb9bca72da963f50b50471ec1aafda3841992
SHA1 hash: c699ce3e004181308e099dbb93fb3b84999bfc2c
MD5 hash: 1d36135b5c0b59b965aa1ff8f8874a4e
humanhash: chicken-earth-nuts-october
File name:1d36135b5c0b59b965aa1ff8f8874a4e
Download: download sample
Signature Stealc
Create hunting rule
File size:2'617'344 bytes
First seen:2024-07-30 10:47:32 UTC
Last seen:2024-07-30 11:27:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 31228b35d765756d4d3dd4ed5d786b22 (4 x Stealc, 1 x MarsStealer)
ssdeep 49152:kocHuEJc+/vrjOfxgi5BRaGutQhXch8MxO+V+rIr0tCwBBY5t1gVOhQg:eHujcvHUGGkQpc2Mxg0r0tCw3Y5t1gYh
Threatray 2'284 similar samples on MalwareBazaar
TLSH T12AC533241B71293FD28219B54933FA9D78FA367F11D1C23D092CD24FAA3560D25A26FE
TrID 28.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
25.5% (.EXE) Win32 Executable (generic) (4504/4/1)
11.6% (.ICL) Windows Icons Library (generic) (2059/9)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 1a72c2db98585c0c (9 x Stealc, 6 x Tofsee, 5 x Smoke Loader)
Reporter zbetcheckin
Tags:32 exe Stealc

Intelligence

File Origin
# of uploads :
2
# of downloads :
371
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
amadey
Create hunting rule
ID:
1
File name:
c015c231f5d013a7031748f95129a969
Verdict:
Malicious activity
Analysis date:
2024-07-30 10:48:58 UTC
Tags:
amadey botnet stealer loader themida stealc
Link:
https://app.any.run/tasks/a24f538b-974f-415d-a932-2cae98c6df20

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a8c4e5c06bd32e596e6fbc
Tags:
Execution Generic Infostealer Network Stealth Trojan Infector
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Launching the default Windows debugger (dwwin.exe)
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
enigma lolbin microsoft_visual_cc packed packed shell32
Link:
https://www.filescan.io/uploads/66a8c4e2b45fbebc0edc27b0/reports/58cbf42d-a9e0-43e9-b074-074c1f4cf6e1/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/e26d7dabcf5095750d11407a9341af6c898034b75f9fff158cc4c4757ec9f51a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0c78b82b-8dfa-4321-8748-24d8822d8d8d
Result
Threat name:
Amadey, Babadeda, Stealc, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1484587
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
PE file has nameless sections
Sample uses string decryption to hide its real strings
Searches for specific processes (likely to inject)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Suspicious File Creation In Uncommon AppData Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Yara detected Amadeys stealer DLL
Yara detected Babadeda
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1484587 Sample: RmwvP67C7X.exe Startdate: 30/07/2024 Architecture: WINDOWS Score: 100 132 Multi AV Scanner detection for domain / URL 2->132 134 Found malware configuration 2->134 136 Malicious sample detected (through community Yara rule) 2->136 138 17 other signatures 2->138 9 RmwvP67C7X.exe 37 2->9         started        14 explorti.exe 2 23 2->14         started        16 explorti.exe 2->16         started        18 3 other processes 2->18 process3 dnsIp4 120 85.28.47.31 GES-ASRU Russian Federation 9->120 122 185.215.113.16 WHOLESALECONNECTIONSNL Portugal 9->122 92 C:\Users\user\AppData\RoamingJKECGHCFIJ.exe, PE32 9->92 dropped 94 C:\Users\user\AppData\Local\...\random[1].exe, PE32 9->94 dropped 96 C:\ProgramData\nss3.dll, PE32 9->96 dropped 98 11 other files (none is malicious) 9->98 dropped 160 Detected unpacking (changes PE section rights) 9->160 162 Detected unpacking (overwrites its own PE header) 9->162 164 Tries to steal Mail credentials (via file / registry access) 9->164 178 7 other signatures 9->178 20 cmd.exe 1 9->20         started        22 WerFault.exe 19 16 9->22         started        124 185.215.113.19 WHOLESALECONNECTIONSNL Portugal 14->124 166 Creates multiple autostart registry keys 14->166 168 Hides threads from debuggers 14->168 170 Tries to detect sandboxes / dynamic malware analysis system (registry check) 14->170 26 6bc8325436.exe 14->26         started        29 350e96ebe8.exe 14->29         started        31 d2cfaf142e.exe 14->31         started        33 explorti.exe 14->33         started        172 Multi AV Scanner detection for dropped file 16->172 174 Tries to evade debugger and weak emulator (self modifying code) 16->174 176 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 16->176 35 firefox.exe 18->35         started        37 cmd.exe 18->37         started        39 6 other processes 18->39 file5 signatures6 process7 dnsIp8 41 RoamingJKECGHCFIJ.exe 4 20->41         started        45 conhost.exe 20->45         started        106 52.168.117.172 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 22->106 82 C:\ProgramData\Microsoft\...\Report.wer, Unicode 22->82 dropped 84 C:\Users\user\AppData\Local\...\axplong.exe, PE32 26->84 dropped 140 Detected unpacking (changes PE section rights) 26->140 142 Tries to detect sandboxes and other dynamic analysis tools (window names) 26->142 144 Tries to evade debugger and weak emulator (self modifying code) 26->144 150 2 other signatures 26->150 146 Detected unpacking (overwrites its own PE header) 29->146 148 Hides threads from debuggers 29->148 47 cmd.exe 31->47         started        108 142.250.176.206 GOOGLEUS United States 35->108 110 142.250.181.227 GOOGLEUS United States 35->110 116 21 other IPs or domains 35->116 86 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 35->86 dropped 88 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 35->88 dropped 49 firefox.exe 35->49         started        51 firefox.exe 35->51         started        53 chrome.exe 37->53         started        55 firefox.exe 37->55         started        57 conhost.exe 37->57         started        59 msedge.exe 37->59         started        112 13.107.21.239 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 39->112 114 13.107.246.40 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 39->114 118 30 other IPs or domains 39->118 file9 signatures10 process11 file12 90 C:\Users\user\AppData\Local\...\explorti.exe, PE32 41->90 dropped 152 Multi AV Scanner detection for dropped file 41->152 154 Detected unpacking (changes PE section rights) 41->154 156 Tries to evade debugger and weak emulator (self modifying code) 41->156 158 4 other signatures 41->158 61 explorti.exe 41->61         started        64 chrome.exe 47->64         started        67 msedge.exe 47->67         started        69 conhost.exe 47->69         started        71 firefox.exe 47->71         started        73 chrome.exe 53->73         started        75 firefox.exe 55->75         started        signatures13 process14 dnsIp15 180 Hides threads from debuggers 61->180 182 Tries to detect sandboxes / dynamic malware analysis system (registry check) 61->182 184 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 61->184 100 192.168.2.5 unknown unknown 64->100 102 192.168.2.6 unknown unknown 64->102 104 239.255.255.250 unknown Reserved 64->104 77 chrome.exe 64->77         started        80 msedge.exe 67->80         started        signatures16 process17 dnsIp18 126 142.250.185.131 GOOGLEUS United States 77->126 128 142.250.185.170 GOOGLEUS United States 77->128 130 10 other IPs or domains 77->130
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e26d7dabcf5095750d11407a9341af6c898034b75f9fff158cc4c4757ec9f51a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e26d7dabcf5095750d11407a9341af6c898034b75f9fff158cc4c4757ec9f51a/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2024-07-30 10:15:02 UTC
File Type:
PE (Exe)
Extracted files:
16
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4jwx3k6pkckxkdirib5jgqnpnseyanfxl6p76fmmytchk7wj6una._file
Verdict:
malicious
Similar samples:
0918a0e9939f235924a5fb65284c97efff83f871bc1851c7e61b1b9800512885
Stealc
2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Stealc
46b661ec72316e0e726009a48b7414cf370d2464d1047dc700628f28d0b4c370
Stealc
47e56f3493eeb0f41a19e825ab34bc25176aef6708f1e20df70f9dbe0c4f1203
Stealc
4dbb6545ef35284ab068616f7da78bc94e0baff5c9e9c297b448f569ce914625
Stealc
942a3a35956be219321c205a4db6ec6e7375c11c1eff2fd9b830798aab093d88
Stealc
9a8a979e60fda73cadd6c9e5c879ef8f5987e8447907fee02060b397daf3f0b0
Stealc
adffd52446d0d94c4f726205482a0c062248d6eb35948df937336957cf747db8
Stealc
+ 2'274 additional samples on MalwareBazaar
Result
Malware family:
stealc
Create hunting rule
Score:
  10/10
Tags:
family:stealc botnet:dana discovery stealer
Link:
https://tria.ge/reports/240730-mv35ba1gpb/
Behaviour
Suspicious use of SetWindowsHookEx
Program crash
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Stealc
Malware Config
C2 Extraction:
http://85.28.47.31
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/99adab4b-6879-436f-aeaa-f1d3a10cc117
Unpacked files
SH256 hash:
144b0da90e8a3721a58d22b460b017854a11c308578ad7f5e3825361fa1cfa5c
MD5 hash:
efedc80482b249d448d8939f4347dd04
SHA1 hash:
b7abc85ad9cc52c264473493b28df8aad2eb0be8
Detections:
stealc
Create hunting rule
Link:
https://www.unpac.me/results/c006775e-1389-488e-adc4-464ffc696502/
Parent samples :
2683b5120c1f81caa318c093ddd9160fcec3a10f3ad35ccd459655bb08a8b0e7
e26d7dabcf5095750d11407a9341af6c898034b75f9fff158cc4c4757ec9f51a
ca248fc7d8d93e7ea0260391cec1402b03619fb6475402a847952837ca4ae4e9
b3f54c2bfe8d4056bdd9e6ff8d9114bf38b6c9ee11b3355e108c233a197fb145
745c8f38e2cd894f6ce759e3096333b3b219a25bdf1446558cac4a92d0cb4e51
48d6fa1f938ce3fa2d54e27373ad93fe13936362d187881a9ba63e9da5946e42
SH256 hash:
e26d7dabcf5095750d11407a9341af6c898034b75f9fff158cc4c4757ec9f51a
MD5 hash:
1d36135b5c0b59b965aa1ff8f8874a4e
SHA1 hash:
c699ce3e004181308e099dbb93fb3b84999bfc2c
Link:
https://www.unpac.me/results/c006775e-1389-488e-adc4-464ffc696502/
Malware family:
Stealc
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e26d7dabcf50/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Stealc
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e26d7dabcf5095750d11407a9341af6c898034b75f9fff158cc4c4757ec9f51a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Stealc

Executable exe e26d7dabcf5095750d11407a9341af6c898034b75f9fff158cc4c4757ec9f51a

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3079150/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteA
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryA
WIN_BASE_IO_APICan Create Filesversion.dll::GetFileVersionInfoA

Comments


Avatar
zbet commented on 2024-07-30 10:47:33 UTC

url : hxxp://185.215.113.16/steam/random.exe