MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e631703a63b03d0bbfe15f325a4031e11ee2780133e8e1661c9aba941e20f46c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e631703a63b03d0bbfe15f325a4031e11ee2780133e8e1661c9aba941e20f46c
SHA3-384 hash:	1b6a28ed7f9fa0ae2cfaa6582966639b1b721a6e06e4f73013b3ade26e87098edf7b12eaf73a7c895a138034600420b6
SHA1 hash:	8d7539405ce4d66798842204a67439bb20f987a1
MD5 hash:	06d21764ffefdde86399f67dd3d66bb5
humanhash:	leopard-wolfram-tango-autumn
File name:	08503199.exe
Download:	download sample
Signature	Stealc Alert Create hunting rule
File size:	212'480 bytes
First seen:	2023-06-01 15:02:18 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	34801832eecaf69fd08479129ee995ac (3 x Rhadamanthys, 2 x Smoke Loader, 1 x Stop)
ssdeep	3072:BXj4RWcZH1Pc6bRdL1OI5XrlZGjliC/MGdLJD5bK6gz:lzMk6bj1OYXPKiCkGdjK
Threatray	25 similar samples on MalwareBazaar
TLSH	T1CB24BE227AF2C0B2D3AB85716930DEA42A7BF8766730808F2354D77E1D306D18A76757
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0008200800020400 (1 x Stealc)
Reporter	Neiki
Tags:	Stealc

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

106

Origin country :

DE

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

08503199.exe

Verdict:

Malicious activity

Analysis date:

2023-06-01 15:07:04 UTC

Tags:

stealc trojan stealer loader

Link:

https://app.any.run/tasks/ecf8d674-8182-400c-9827-44214a2125c5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/394476/

ClamAV Detected

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

DNS request

Sending an HTTP GET request

Creating a file

Reading critical registry keys

Sending a custom TCP request

Changing a file

Creating a file in the %AppData% subdirectories

Creating a window

Running batch commands

Creating a process with a hidden window

Launching a process

Stealing user critical data

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

greyware packed xpack

Link:

https://www.filescan.io/uploads/6478b3280a98d88b592abe8a/reports/bbd57cd4-b663-43eb-be77-946047e3ec46/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/e631703a63b03d0bbfe15f325a4031e11ee2780133e8e1661c9aba941e20f46c

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Stealc

Malware family:

Stealc

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4dedf3b7-a053-4627-9b8a-ea0dfef37747

Joe Sandbox Stealc, Vidar

Result

Threat name:

Stealc, Vidar

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1246956

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found evasive API chain (may stop execution after checking locale)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Self deletion via cmd or bat file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Stealc

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e631703a63b03d0bbfe15f325a4031e11ee2780133e8e1661c9aba941e20f46c/

ReversingLabs TitaniumCloud Win32.Trojan.Glupteba

Threat name:

Win32.Trojan.Glupteba

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-01 14:00:18 UTC

File Type:

PE (Exe)

Extracted files:

10

AV detection:

20 of 24 (83.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4yyxaotdwa6qxp7bl4zfuqbr4epoe6abgpuoczq4tk5jihra6rwa._file

Threatray malicious

Verdict:

malicious

Similar samples:

17652d33f21e1d3b977e02389d90e796e3b3e0fce1e910f2e9a8fb14b4548ed1

Stealc

24089814a99edccddb1a0b87184bb27b1838fb78c91becfb5735b2f187c48f6c

Stealc

34d81fa01e7570ee734e04e8d2be5c2d54c3a343ad3340b26105627b6124a2db

Stealc

35d4d533678078e58d15b4a47ab0774b0c13b2ab24fa35521131663c3f29e93b

Stealc

3e1e3a8cf5efe616591c7b6b91265b3adf8b9bc594ec7ea9a06e7d20cde4a2ca

Stealc

5da7c2a4b3b0cb14cccd91ab7d3495945204eb705664dc764a54f23717e87b6b

Stealc

7b2acf4e50455c57cfd5ec624c1655e3ca4c5fc4fcafed3ff2ff2e4fd75a2894

Stealc

8cd748b1cc76a501254b9b130c4193efc7882493b750a5ee07a50b2443b6383c

Stealc

cb7f4e286a4a8fdfa525168591131d37019090d94040feb13c8078c4a7ae4b37

Stealc

f5915d3efdd31d03fdcd84c9ea109232417c4861996a3e6eda16c7156fb59042

Stealc

+ 15 additional samples on MalwareBazaar

Hatching Triage stealc

Result

Malware family:

stealc

Alert

Create hunting rule

Score:

  10/10

Tags:

family:stealc discovery spyware stealer

Link:

https://tria.ge/reports/230601-se1xxaeh66/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Detects Stealc stealer

Stealc

Malware Config

C2 Extraction:

http://publisherget.top/410b5129171f10ea.php

UnpacMe win_stealc_w0 win_stealc_auto win_stealc_a0

Unpacked files

SH256 hash:

28611b67339f4ca34958b6474b5e7da9bfa6850c8c3b7701410272a6e49f6614

MD5 hash:

917d92f9d26aa4228f42639312c8db9e

SHA1 hash:

03a62d664410eab1787dbac00de4efe7ced5d119

Detections:

win_stealc_w0

Alert

Create hunting rule

win_stealc_auto

Alert

Create hunting rule

win_stealc_a0

Alert

Create hunting rule

Link:

https://www.unpac.me/results/d1a5fd5d-5faa-4ccd-b14d-520052e03d69/

Parent samples :

76879ab7212540d378168b2564b9f37db4537b50f6dc369c26b647e85c444c57
2436911de6028f64f426467d1d1b8cd3b50e3c84fca97ac7a2239ec9a1e394b9
320392e748f8128753b6c297ac2beedb2e1fd1d0a3fefddbc212b8a13cceb507
790eeb5febfc4bcc7aa3b14c3dcd81a4fbd00bf727f0c0cd9623e4d3179fad94
06c6faf5b7bdac61e43a64b8e71a53bf7467acafabb460733866a9eab4540109
f2b4c728867bcc659b1f180783aa3c748f2ee95f0d2f6ed2fdc13869b1b9f0ff
35d4d533678078e58d15b4a47ab0774b0c13b2ab24fa35521131663c3f29e93b
e631703a63b03d0bbfe15f325a4031e11ee2780133e8e1661c9aba941e20f46c

SH256 hash:

e631703a63b03d0bbfe15f325a4031e11ee2780133e8e1661c9aba941e20f46c

MD5 hash:

06d21764ffefdde86399f67dd3d66bb5

SHA1 hash:

8d7539405ce4d66798842204a67439bb20f987a1

Link:

https://www.unpac.me/results/d1a5fd5d-5faa-4ccd-b14d-520052e03d69/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e631703a63b03d0bbfe15f325a4031e11ee2780133e8e1661c9aba941e20f46c

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/394476/