MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00926795599d6af73ade5d42b97d88a487024f3169dd625bf20d213a6a3ecba3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhoenixStealer


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00926795599d6af73ade5d42b97d88a487024f3169dd625bf20d213a6a3ecba3
SHA3-384 hash: 07fa19e30fd2465833fffdd4983fded9f9fa996e3e942cae17b2fe748b15a4e3bc865ae2b000fcac460b1e2e21bbcda6
SHA1 hash: 5127962f1fa9cfbd652d59575d1466dd673dfcc7
MD5 hash: 428ec9e689b020e46b7b5432bd6dd758
humanhash: echo-beer-lamp-table
File name:1.bin
Download: download sample
Signature PhoenixStealer
Create hunting rule
File size:1'872'792 bytes
First seen:2022-07-17 15:49:46 UTC
Last seen:2022-07-17 16:41:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash da0a8429d07681e0f845d1d4f08ae833 (28 x RedLineStealer, 2 x ArkeiStealer, 1 x PhoenixStealer)
ssdeep 24576:QlA3ZMDU8YqY4TRJi6ZMKNdokTzzAzbG1OL6KGducfXJsr0fcs2kHIaJ+aI3Nzr+:QlqCD7HXAXGVCcfXJsABl+aI3NzrYL
TLSH T1F8859D39EB4719B4DA17A3B1859EEB3B9B14B5248022AF7FFF0EEB0C64330126C95155
TrID 36.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
23.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.0% (.EXE) Win32 Executable (generic) (4505/5/1)
4.5% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter KdssSupport
Tags:exe PhoenixStealer


Avatar
KdssSupport
Uploaded with API

Intelligence

File Origin
# of uploads :
2
# of downloads :
313
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Atom.zip
Verdict:
Malicious activity
Analysis date:
2022-07-17 13:36:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5dc35faa-692e-4c69-94b3-78e1329586ae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/291358/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.118385.7746.29215.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the system32 subdirectories
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/26538/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionGetTickCount
EvasionQueryPerformanceCounter
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Certishell
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bb8a33fe-b24b-4373-aabc-b74996d47466
Result
Threat name:
Panda Stealer, Phoenix Stealer
Create hunting rule
Detection:
malicious
Classification:
evad.troj.spyw
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1034888
Signature
Contains functionality to inject code into remote processes
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Writes to foreign memory regions
Yara detected Panda Stealer
Yara detected Phoenix Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00926795599d6af73ade5d42b97d88a487024f3169dd625bf20d213a6a3ecba3/
Threat name:
Win32.Infostealer.Convagent
Create hunting rule
Status:
Malicious
First seen:
2022-07-17 15:50:10 UTC
File Type:
PE (Exe)
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=acjgpfkztvvpoow6lvbls7miusdqetzrnhowew7sbuqtu2r6zorq._file
Result
Malware family:
phoenixstealer
Create hunting rule
Score:
  10/10
Tags:
family:phoenixstealer stealer
Link:
https://tria.ge/reports/220717-s9xhzaegdj/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
PhoenixStealer
Unpacked files
SH256 hash:
6dce81d9b046513940ea866e9398ec06c42f251f627f601f83ca112dc6158068
MD5 hash:
46e92210e279c4531a543ed27d0910f6
SHA1 hash:
949e3fe9660737e4b919900906dd3a4aebcbff11
Link:
https://www.unpac.me/results/d12489fa-ee23-46c9-895d-5e08fc3112ba/
SH256 hash:
00926795599d6af73ade5d42b97d88a487024f3169dd625bf20d213a6a3ecba3
MD5 hash:
428ec9e689b020e46b7b5432bd6dd758
SHA1 hash:
5127962f1fa9cfbd652d59575d1466dd673dfcc7
Link:
https://www.unpac.me/results/d12489fa-ee23-46c9-895d-5e08fc3112ba/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
Link:
https://yomi.yoroi.company/submissions/00926795599d6af73ade5d42b97d88a487024f3169dd625bf20d213a6a3ecba3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PhoenixStealer

Executable exe 00926795599d6af73ade5d42b97d88a487024f3169dd625bf20d213a6a3ecba3

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/291358/

Comments