MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 620b017cb8cb6b5d41732a0d63777f163e2d4bf0e44a90d88f788427b9ef26a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XFilesStealer

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	620b017cb8cb6b5d41732a0d63777f163e2d4bf0e44a90d88f788427b9ef26a6
SHA3-384 hash:	4783517ee54fba34a701dc0acbbb1f268159f968c166f85cebca20180e55a8939fa730ef587889c697c647222e3ab684
SHA1 hash:	296816166317c6e23ff604210fb79fb781477e9b
MD5 hash:	bfea4dad97141de42c7f431fcb95f1c3
humanhash:	fruit-item-foxtrot-mango
File name:	bfea4dad97141de42c7f431fcb95f1c3.exe
Download:	download sample
Signature	XFilesStealer Create hunting rule
File size:	4'975'442 bytes
First seen:	2022-06-27 08:47:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a1a66d588dcf1394354ebf6ec400c223 (49 x RedLineStealer, 7 x CryptBot, 4 x AZORult)
ssdeep	98304:a5aFhi9K+UVDfHce+9r4S+XZQCN7qXKz7tyObBgi1HI7KrjM:a5aFyech9US+JF7RdyOtgiDM
Threatray	1'797 similar samples on MalwareBazaar
TLSH	T175363397F7E18CF7C05B29B231136B17B536E2792B1909EB13680A183A90AC6767D374
TrID	43.3% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 27.6% (.EXE) Win64 Executable (generic) (10523/12/4) 13.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.3% (.EXE) OS/2 Executable (generic) (2029/13) 5.2% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):
dhash icon	d292b0b2da36bcbe (11 x AsyncRAT, 7 x Metasploit, 6 x CoinMiner)
Reporter	abuse_ch
Tags:	exe XFilesStealer

Intelligence

File Origin

# of uploads :

# of downloads :

221

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/283476/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% subdirectories

Сreating synchronization primitives

Creating a process from a recently created file

Creating a process with a hidden window

Launching a process

Unauthorized injection to a recently created process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

keylogger overlay packed shell32.dll

Link:

https://www.filescan.io/uploads/62b96f04e88d6da4ffcbb40b/reports/dac42db9-50b5-47c9-8105-e565f695ed6e/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/636d3806-4188-4f9b-9675-6ba9673f1db3

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1020359

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Contains functionality to register a low level keyboard hook

Creates an undocumented autostart registry key

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/620b017cb8cb6b5d41732a0d63777f163e2d4bf0e44a90d88f788427b9ef26a6/

Threat name:

Win32.Adware.RedCap

Status:

Malicious

First seen:

2022-06-26 21:06:53 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

15 of 26 (57.69%)

Threat level:

1/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mifqc7fyznvv2qltfigwg537cy7c2s7q4rfjbweppcccpoppe2ta._file

Verdict:

malicious

XFilesStealer

17281e25687b88803fe21608d4c1dca23fe449075c152d97525ba6a61dc35b5c

XFilesStealer

375e3b9aca92cb15f9e872d6d8495b40bef87ebce8fb10a67d7e6e816da3c40f

XFilesStealer

3efa859091d8e7994ad47304244de9b0d14d4cfb5dca3df2a13aa7c0a62a021d

XFilesStealer

45b9f90bee542ccb1e839ba824246f94363e35610981b9620429beecfcedc66b

XFilesStealer

792bc8203c1c9e51685d264f5bb7a78f3a3fcf15ff7bfba813e2b5affa0909c8

XFilesStealer

89fd50a006af9537d9181a8d2dd4872cd29639150ef2ed96a93ed1c3ad1967a4

XFilesStealer

b826516b9fe4412f730527fa84dd3f1f927b58c933fad403dc64e54815cb147a

XFilesStealer

e4af6a6b4243bb6971be7edc28f16198ff88734d6a764dcddc6f5c6424309bd6

XFilesStealer

+ 1'787 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:xmrig miner persistence

Link:

https://tria.ge/reports/220627-kqe6ksbha8/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

XMRig Miner Payload

Modifies WinLogon for persistence

xmrig

Unpacked files

SH256 hash:

620b017cb8cb6b5d41732a0d63777f163e2d4bf0e44a90d88f788427b9ef26a6

MD5 hash:

bfea4dad97141de42c7f431fcb95f1c3

SHA1 hash:

296816166317c6e23ff604210fb79fb781477e9b

Link:

https://www.unpac.me/results/4c9fb574-8ead-4489-9456-d1095d2be1ff/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/620b017cb8cb6b5d41732a0d63777f163e2d4bf0e44a90d88f788427b9ef26a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.