MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc9884b66021905c9752d846420200c69920fa7214812b29489c445261b5fae9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ErbiumStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fc9884b66021905c9752d846420200c69920fa7214812b29489c445261b5fae9
SHA3-384 hash: 98b844594fd3a62c9e19f5a88e1ebd56dbfa04737e381b09d4cd24105b4935c8210b4774f6e767bf1386042edf3c24ae
SHA1 hash: e268fa82264aca536d961cc6e9346a30036f9691
MD5 hash: 1af7140456c3b1089ca30cb1682ff91e
humanhash: tennessee-texas-oranges-angel
File name:file
Download: download sample
Signature ErbiumStealer
Create hunting rule
File size:898'560 bytes
First seen:2022-11-13 20:11:00 UTC
Last seen:2022-11-14 07:05:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0c737368c9c218d6e64e05306282bcfe (3 x RedLineStealer, 1 x ErbiumStealer)
ssdeep 12288:MacTpyxGG/c2MEYzypR8eNbSj+0LlJFM1kjnYtMUfo28HcuCk447OMoLt:MacM5NRE+Si1kjnMQznV447ot
Threatray 1'033 similar samples on MalwareBazaar
TLSH T16615DF03396BC16ACC56D2F058716EAF5E2DA909FD967FEA49045CC78018AEB40C1FF9
TrID 40.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.0% (.SCR) Windows screen saver (13097/50/3)
13.6% (.EXE) Win64 Executable (generic) (10523/12/4)
8.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter andretavare5
Tags:ErbiumStealer exe


Avatar
andretavare5
Sample downloaded from https://vk.com/doc760750097_656015094?hash=zz8WTXZAj5BWozmO92XJ1JoNDAzZuysU9uHFMho2zDc&dl=G43DANZVGAYDSNY:1668370112:hZUGMOQJIKA90dz86F9vTaNknHz2eIR885M0CCiv3FH&api=1&no_preview=1#build1

Intelligence

File Origin
# of uploads :
275
# of downloads :
230
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-13 20:12:35 UTC
Tags:
opendir loader stealer
Link:
https://app.any.run/tasks/81d7054f-7d71-43b0-b863-cecbb01c1b04

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/333425/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Steam.34045.27093.13943.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Launching a process
Сreating synchronization primitives
Creating a window
Sending an HTTP GET request
DNS request
Creating a file
Creating a process from a recently created file
Behavior that indicates a threat
Creating a file in the %AppData% subdirectories
Running batch commands
Reading critical registry keys
Creating a file in the %temp% directory
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63714f56f75d59fef0b944c5/reports/c1ffe1d9-6ac0-4cb9-b66c-59ffd3ab0b17/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/143a82b0-eb1d-4c94-905f-f624214603f1
Result
Threat name:
Laplas Clipper, Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1112422
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Laplas Clipper
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 745118 Sample: file.exe Startdate: 13/11/2022 Architecture: WINDOWS Score: 100 54 Snort IDS alert for network traffic 2->54 56 Multi AV Scanner detection for domain / URL 2->56 58 Antivirus detection for URL or domain 2->58 60 5 other signatures 2->60 10 file.exe 1 2->10         started        13 svcupdater.exe 1 2->13         started        process3 dnsIp4 66 Contains functionality to inject code into remote processes 10->66 68 Writes to foreign memory regions 10->68 70 Allocates memory in foreign processes 10->70 72 Injects a PE file into a foreign processes 10->72 16 vbc.exe 28 10->16         started        21 conhost.exe 10->21         started        52 clipper.guru 45.159.189.115, 49694, 80 HOSTING-SOLUTIONSUS Netherlands 13->52 74 Machine Learning detection for dropped file 13->74 signatures5 process6 dnsIp7 46 77.73.133.53, 49691, 49702, 80 AS43260TR Kazakhstan 16->46 48 mamamiya137.ru 77.73.133.46, 443, 49690 AS43260TR Kazakhstan 16->48 50 77.73.133.50, 49692, 49703, 80 AS43260TR Kazakhstan 16->50 36 C:\Users\user\Desktop\huqkxnfzznhalqje.exe, PE32+ 16->36 dropped 38 C:\Users\user\AppData\Local\...\softokn3.dll, PE32 16->38 dropped 40 C:\Users\user\AppData\Local\...\freebl3.dll, PE32 16->40 dropped 42 9 other files (5 malicious) 16->42 dropped 62 Tries to harvest and steal browser information (history, passwords, etc) 16->62 23 huqkxnfzznhalqje.exe 2 16->23         started        file8 signatures9 process10 file11 44 C:\Users\user\AppData\...\svcupdater.exe, PE32+ 23->44 dropped 64 Machine Learning detection for dropped file 23->64 27 cmd.exe 1 23->27         started        signatures12 process13 signatures14 76 Uses schtasks.exe or at.exe to add and modify task schedules 27->76 30 conhost.exe 27->30         started        32 schtasks.exe 1 27->32         started        process15 process16 34 conhost.exe 30->34         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fc9884b66021905c9752d846420200c69920fa7214812b29489c445261b5fae9/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2022-11-13 20:11:09 UTC
File Type:
PE (Exe)
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7smijntaegifzf2s3bdeeaqay2msb6tscsaswkkitrcfeynv7luq._file
Verdict:
malicious
Similar samples:
0fddeb14acea742a808d10f5c6da7f411ea92e44f5e85b39cb8e9cf5e104a0ae
ErbiumStealer
365b72e0c1452e528e52d162db90916a924b542cdc8d2a696a0c6883446239d4
ErbiumStealer
6b286ebe937d8a7057dfcb7110ef0badd4e28a19d264a1b865d1573690e3c4bb
ErbiumStealer
d4f7c5d0b04ff56a3134b2edfcef0a690b4d0f68ff047cbf624ab12d5dd8998d
ErbiumStealer
e70ed589ed297cfb772afa999b6483c72ad0f68bc8bb6b06d94ba67f497417e2
ErbiumStealer
fbd26c2dd1ce905135c5f1e33a946956abc1d9c588339d5a129cd86aed651dd5
ErbiumStealer
+ 1'023 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/221113-yx89wscg86/
Behaviour
Creates scheduled task(s)
GoLang User-Agent
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Uses the VBS compiler for execution
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
dfde1cd03188e38374bce3c18b6db21b17919baaa6d0de3036f514f5e17087dc
MD5 hash:
2df5b1cb1ff653bc36c785bab0e1f3b6
SHA1 hash:
8dd4633124d1bfb9198c007ddc8397a25d2635d1
Link:
https://www.unpac.me/results/3207c5c7-8a4d-4c7e-a7ef-634a0854da07/
SH256 hash:
fc9884b66021905c9752d846420200c69920fa7214812b29489c445261b5fae9
MD5 hash:
1af7140456c3b1089ca30cb1682ff91e
SHA1 hash:
e268fa82264aca536d961cc6e9346a30036f9691
Link:
https://www.unpac.me/results/3207c5c7-8a4d-4c7e-a7ef-634a0854da07/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fc9884b66021905c9752d846420200c69920fa7214812b29489c445261b5fae9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/333425/

Comments