SemanticsAV Intelligence Report

Executive Verdict Summary

The detection assessment for this file is MALICIOUS with 100.0% certainty. Analysis reveals significant structural similarities to the Stealc malware family, indicating a likely genetic relationship and a high probability of this sample also belonging to or being derived from the Stealc lineage.

Technical Analysis

The target sample exhibits numerous structural indicators consistent with sophisticated malware. Notably, the presence of a TLS callback and the HIGH_ENTROPY_VA and TERMINAL_SERVER_AWARE characteristics in its DLL characteristics suggest advanced evasion and operational design. The file's compilation date and the specific sections present, including .rsrc, .idata, .tls, .themida, .boot, and .reloc, align with patterns observed in custom-developed or heavily obfuscated binaries. The presence of version information attributing the file to "Simutronics Corporation" with a description of "Titan Solution Platform" and internal name "nebulaplatform" suggests a potential attempt to masquerade as legitimate software.

The analysis of similar samples from our intelligence database reveals a strong genetic link to the Stealc malware family. Four out of the five most similar samples (90.3% similarity to reference #1) are classified as Stealc. These shared structural patterns, such as the specific data directories present, the arrangement of sections, and the typical use of kernel32.dll imports with a single function, strongly suggest a common development origin or shared codebase evolution. The divergence in compilation dates and minor variations in version information strings across these similar Stealc samples point towards ongoing development and potential polymorphism within the family.

Furthermore, the presence of one sample classified as Amadey (81.3% similarity to reference #4) in proximity to the Stealc samples is noteworthy. While the structural similarity is lower, the Amadey sample shares some architectural choices, such as the presence of a TLS callback and similar section structures. This suggests a potential, albeit indirect, relationship or the utilization of overlapping tooling or techniques between Stealc and Amadey operations, possibly indicating Amadey's role as a dropper or facilitator for Stealc payloads.

Threat Intelligence Context

The structural analysis strongly suggests that this sample is a variant of the Stealc malware family, with a geometric similarity of up to 90.3% to known Stealc samples. Stealc is a sophisticated information stealer known for its ability to exfiltrate credentials from various applications, including web browsers, cryptocurrency wallets, and FTP clients. It often employs obfuscation techniques and packing to evade detection. Its typical objectives revolve around financial gain through credential theft and espionage.

The presence of a single Amadey sample (81.3% similarity) in the proximity of Stealc samples warrants further attention. Amadey is a well-documented malware loader and downloader often used to deliver secondary payloads, including stealer malware. The association suggests that Stealc may be distributed or deployed via Amadey campaigns. This cross-family attribution indicates a layered attack infrastructure, where Amadey acts as the initial point of compromise or delivery mechanism, followed by the execution of Stealc to achieve its data exfiltration objectives.

The convergence of structural patterns across multiple Stealc variants, compiled at different times and exhibiting slightly varied legitimate-sounding version information, highlights the dynamic nature of this threat. The reuse of common structural elements and potentially shared codebases across these samples underscores the importance of recognizing the genetic lineage of Stealc, even when presented with polymorphic variations or attempts at masquerading.

Recommendations and Response Strategy

Based on the high certainty of this sample being a Stealc variant, potentially delivered by Amadey, immediate response actions should focus on identifying and removing both types of malware. Prioritize endpoint detection and response (EDR) solutions capable of identifying process injection and unusual network communications, as Stealc is known to exhibit such behaviors. Implement network-level blocking for known Amadey and Stealc command-and-control infrastructure. Conduct a comprehensive scan of the environment using signatures and behavioral detection rules targeting Stealc's credential harvesting capabilities and Amadey's known distribution vectors. Advise users to reset credentials for critical applications and services compromised by Stealc. Monitor for the presence of suspicious executables in temporary directories or uncommon startup locations, as Amadey often drops payloads there.