MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd492b317c4004ce5046da22cbd0f14a698dec548eff87eee4f062284bf41505. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ElysiumStealer


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd492b317c4004ce5046da22cbd0f14a698dec548eff87eee4f062284bf41505
SHA3-384 hash: 0550d9beea0006c74ed62b9e5925157217d9f41f19d111ee5286806470fb0b74ec8f2419fab1499841bb75ed8f88480e
SHA1 hash: 22da268e12c894698d4cf7cd6c4f69762ff68c4a
MD5 hash: b3102c8ff03714b22e9408fcf3d63ade
humanhash: hamper-foxtrot-fillet-washington
File name:AntiPublic.exe
Download: download sample
Signature ElysiumStealer
Create hunting rule
File size:460'288 bytes
First seen:2021-07-17 01:55:15 UTC
Last seen:2021-07-17 02:35:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 3072:iOdVUbzCTdsyTW2NIH8XnqOFq47Fk3mYRJJFSnPlD6SdfZFsWe/refv69zeTZ1Ou:iGhe/Kn698sLMJstdXuvNbOD
Threatray 26 similar samples on MalwareBazaar
TLSH T13EA4D73036A3915DDC2A47710C3A92C227B67A697F14CBDE359D171CDE225238B32BB9
Reporter Anonymous
Tags:ElysiumStealer exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Antipublic [fixed].rar
Verdict:
Malicious activity
Analysis date:
2021-06-21 13:28:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/87b19d08-f1a8-4e95-9552-4cde49c80381

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172304/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.29975.2604.2350.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/88a0c6f5-c48e-404e-ad68-f0a6b16f0afc
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/817759
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd492b317c4004ce5046da22cbd0f14a698dec548eff87eee4f062284bf41505/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2019-12-07 05:13:40 UTC
AV detection:
19 of 47 (40.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7veswml4iacm4ucg3irmxuhrjjuy33cur37yp3xe6brcqs7ucucq._file
Verdict:
unknown
Similar samples:
3a78a3a475ff61cc48c9cf5b07b67cd05d0cb7c0fc719b2f7e7a579648caeda2
ElysiumStealer
71b928fd0b29e21bbfa4755b5347f4dc40653a82ec7ecf4947e325dbec23abaa
ElysiumStealer
84b4de2aa2a30edc31ad72fd35b012d54c8aac112c48abe1cfc434a9fb57511f
ElysiumStealer
924bb78c8e816ebd25d656fb6cf0387449cd4b3cd55846c99d4f0ddb47f71dd5
ElysiumStealer
9e7156a3ee3d864ea24daa5db9c90bc9505e034ed45dab8115490fda05c113d9
ElysiumStealer
a21b545b7aab8405487b134cbc179aab85ee49af77928d896f9904fefcfce076
ElysiumStealer
bc06c918fab5afbb61d15611dedadbc9012cf9e4979e9d3f261a9046c306bb87
ElysiumStealer
d33a4d3ac76095145e6061009fc20432b5c2c6ec4a828c7b6956ea5f072f2c34
ElysiumStealer
ebd46183b53aca011bbd1c430296089477faf2e2130e8d9da3c633f9a38e3488
ElysiumStealer
f87ed79fbb1a2228c97fb59127eade39c4f8218fa28ddd76b50da177d81438e3
ElysiumStealer
+ 16 additional samples on MalwareBazaar
Result
Malware family:
elysiumstealer
Create hunting rule
Score:
  10/10
Tags:
family:elysiumstealer stealer
Link:
https://tria.ge/reports/210717-y93vyz5dk2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
ElysiumStealer
ElysiumStealer Payload
Unpacked files
SH256 hash:
7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f
MD5 hash:
94173de2e35aa8d621fc1c4f54b2a082
SHA1 hash:
fbb2266ee47f88462560f0370edb329554cd5869
Link:
https://www.unpac.me/results/ef2d0106-b52f-497e-9551-9d5fd838fdcd/
SH256 hash:
0af8e3865ca005a005a69c55f4f691b2d9504c796755a0bcee73159f719996fd
MD5 hash:
c5a8489ba2bfe112007d2356c54e25b6
SHA1 hash:
a43791ccbe3090c81c3f4911df59a99a175e7c21
Link:
https://www.unpac.me/results/ef2d0106-b52f-497e-9551-9d5fd838fdcd/
SH256 hash:
fd492b317c4004ce5046da22cbd0f14a698dec548eff87eee4f062284bf41505
MD5 hash:
b3102c8ff03714b22e9408fcf3d63ade
SHA1 hash:
22da268e12c894698d4cf7cd6c4f69762ff68c4a
Link:
https://www.unpac.me/results/ef2d0106-b52f-497e-9551-9d5fd838fdcd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fd492b317c4004ce5046da22cbd0f14a698dec548eff87eee4f062284bf41505

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/172304/

Comments