MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10280ae883a86aae151fbceaf56912f5b71f6e1432ee59d21cda735885425a2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PhoenixStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10280ae883a86aae151fbceaf56912f5b71f6e1432ee59d21cda735885425a2b
SHA3-384 hash: ad941cc312bcba88e8640bfa5ce659b09946735a1ef4b5eb9a7def54d190d48e8be19cb358866f5bf5eab64ae0a77c81
SHA1 hash: a2498266ce7dde285cf5d8f5a7dbabc83ac098fd
MD5 hash: c338c0ae185d5592efba7ff5669e55e3
humanhash: double-coffee-maryland-hawaii
File name:37450663.exe
Download: download sample
Signature PhoenixStealer
Create hunting rule
File size:558'592 bytes
First seen:2022-03-21 06:56:41 UTC
Last seen:2022-03-22 01:01:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 06c6e92acd3ff57b00b3132976b3f6d6 (32 x PhoenixStealer, 2 x PandaStealer, 1 x Worm.Ramnit)
ssdeep 12288:F7vT8cGUCZmxIwNjVGCXZqmmJUL+JHkdIUnjoqhwAw4d:Fz4BUCZmxIw1VGCXZ5mJdkdZnBhb
Threatray 51 similar samples on MalwareBazaar
TLSH T164C4BE17E6428076E4632430265D9B7649BD76300A2655BBF3C42E2D9EF02F2AB35F37
Reporter adm1n_usa32
Tags:exe PhoenixStealer

Intelligence

File Origin
# of uploads :
2
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Alfonoso
Create hunting rule
Link:
https://www.capesandbox.com/analysis/253308/
Detection(s):
Win.Malware.Zusy-9812688-0
Create hunting rule

Win.Malware.Zusy-9828887-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/10021/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe greyware obfuscated shell32.dll stealer update.exe
Link:
https://www.filescan.io/uploads/623821c4dfdfa8501cc56468/reports/6b84546b-004f-4b04-95a0-b7561cd5dcc9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Panda Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/81f3e4f6-795e-4fc0-89a6-90900078b927
Result
Threat name:
Panda Stealer Phoenix Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/960449
Signature
Antivirus / Scanner detection for submitted sample
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Yara detected Panda Stealer
Yara detected Phoenix Stealer
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10280ae883a86aae151fbceaf56912f5b71f6e1432ee59d21cda735885425a2b/
Threat name:
Win32.Trojan.Matanbuchus
Create hunting rule
Status:
Malicious
First seen:
2022-02-21 23:36:38 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
25 of 26 (96.15%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
10c760b38e37d7df4fdb3caa56328e51943ac422018b1261fbd4820cdaa046d3
PhoenixStealer
15a772d0dcbde0cffde9b58be5007244fd23159daaa67110f53259ffff69b3c9
PhoenixStealer
2779a981bae47dccca241d3af3e2b794722dbad3aa7e04a81198e8e9267b0882
PhoenixStealer
2b697dedde68e57f4ce0031983226e1db30f0e41e52e5307f1bb1eddc87ae7e7
PhoenixStealer
3cc17e8a578397b8dad4299539f31925ea3777455d112dafbaf7df283c7cb11e
PhoenixStealer
7a76c39cebc89415a125d7773796ac539e0fc0f36a4663ec0ec75fec0d46bb7c
PhoenixStealer
a2ab9acad51433ee88a2558ad59f5171b8bc3da7ffe80818423d478f94adf618
PhoenixStealer
a97397b1d9ac7e1b1aab153d2529680c0d6f0977c9e2f68c3febd1661629dbe1
PhoenixStealer
bf3208f8363c2f4c8f0c431ec05376c3b1fefff9175423bb242755173229308e
PhoenixStealer
c153071c43613a6ff4c454e3fda8c29ac41908fa8e6dab9d9f021e9263b456a2
PhoenixStealer
+ 41 additional samples on MalwareBazaar
Result
Malware family:
phoenixstealer
Create hunting rule
Score:
  10/10
Tags:
family:phoenixstealer stealer
Link:
https://tria.ge/reports/220321-hqzh4shgc2/
Behaviour
PhoenixStealer
Unpacked files
SH256 hash:
10280ae883a86aae151fbceaf56912f5b71f6e1432ee59d21cda735885425a2b
MD5 hash:
c338c0ae185d5592efba7ff5669e55e3
SHA1 hash:
a2498266ce7dde285cf5d8f5a7dbabc83ac098fd
Link:
https://www.unpac.me/results/f396a3be-5d5d-42e9-899f-b71f87544e7f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/10280ae883a86aae151fbceaf56912f5b71f6e1432ee59d21cda735885425a2b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_Alfonoso
Create hunting rule
Author:ditekSHen
Description:Detects Alfonoso / Shurk / HunterStealer infostealer
Rule name:SUSP_XORed_URL_in_EXE
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:XOREngine_Misc_XOR_Func
Create hunting rule
Author:smiller cc @florian @wesley idea on implementation with yara's built in XOR function
Description:Use with care, https://twitter.com/cyb3rops/status/1237042104406355968

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

PhoenixStealer

Executable exe 10280ae883a86aae151fbceaf56912f5b71f6e1432ee59d21cda735885425a2b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2072516/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2072999/
  
URLhaus
https://urlhaus.abuse.ch/url/2073089/
Cape
Cape
https://www.capesandbox.com/analysis/253308/

Comments