MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68a2c4cce8c8e8cdf819d8b4f8ab88c0c851fb4ca0dcc07d562a6befc4172380. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XFilesStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68a2c4cce8c8e8cdf819d8b4f8ab88c0c851fb4ca0dcc07d562a6befc4172380
SHA3-384 hash: c1c411a307c971e2771ff154e2febb11296e0f3f6378ee0ba490b9cb60342c4c3f2aa44464849c515b99a5d311113472
SHA1 hash: efc0a95732ccb84e065fbf6cc0bca6f0dd4e7efa
MD5 hash: 340c112e41da74f58eb3cf514cd03932
humanhash: sink-music-violet-mexico
File name:dropper_cs.exe
Download: download sample
Signature XFilesStealer
Create hunting rule
File size:18'944 bytes
First seen:2022-09-20 08:21:23 UTC
Last seen:2022-09-26 06:56:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'859 x AgentTesla, 19'785 x Formbook, 12'305 x SnakeKeylogger)
ssdeep 384:OHz1vHASc76wQ/J1O95acb43vK4oTb7Vnwb4q/4w8/jKXuQT:o1AUBcfVneQrKXHT
Threatray 3 similar samples on MalwareBazaar
TLSH T1DE82294D7BD9D704C5ED0B7848B3621043B5E756AA32EF9A2CC941CA5873A818E50FBF
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter JAMESWT_WT
Tags:exe poshc2 XFilesStealer

Intelligence

File Origin
# of uploads :
3
# of downloads :
280
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
dropper_cs.exe
Verdict:
Suspicious activity
Analysis date:
2022-07-31 07:04:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9b8f3ffb-71b7-4109-b3ab-cba5db7f8a4c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/311589/
Detection(s):
SecuriteInfo.com.Generic.Dropper.PoshC2.A.21BE7D9C.8674.30378.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Сreating synchronization primitives
Sending a custom TCP request
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed shell32.dll
Link:
https://www.filescan.io/uploads/63297844b333b2ec6b391f1e/reports/f53645ca-fd52-4267-828a-c24b499c0f48/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
PoshC2
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/06ba39a8-bedf-490c-bd21-011f8317d172
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1073500
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Generic Downloader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68a2c4cce8c8e8cdf819d8b4f8ab88c0c851fb4ca0dcc07d562a6befc4172380/
Threat name:
ByteCode-MSIL.Dropper.PoshC2
Create hunting rule
Status:
Malicious
First seen:
2022-07-25 05:20:45 UTC
File Type:
PE (.Net Exe)
AV detection:
23 of 26 (88.46%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ncrmjthizdum36az3c2prk4iydefd62mudoma7kwfjv67raxeoaa._file
Verdict:
malicious
Similar samples:
7af55b95ea75191bf2ba93b1a82668ce7abeb7c3539bceb442ce16bcab234835
XFilesStealer
8699c058f3f99abd2e6f486d92299e830ff9c69e62abfbfe8bf4e74fb3663512
XFilesStealer
b4e79c634347e81ec37de162f5bae756f60cdbfa4b0af7c9a11d25f4a51a3ef6
XFilesStealer
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220920-j9kdzacde7/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/564e08ba-8426-4d38-bb6d-b038fd889df0
Unpacked files
SH256 hash:
68a2c4cce8c8e8cdf819d8b4f8ab88c0c851fb4ca0dcc07d562a6befc4172380
MD5 hash:
340c112e41da74f58eb3cf514cd03932
SHA1 hash:
efc0a95732ccb84e065fbf6cc0bca6f0dd4e7efa
Link:
https://www.unpac.me/results/81f2d34b-cdc8-428d-88a0-8590b170366d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/68a2c4cce8c8e8cdf819d8b4f8ab88c0c851fb4ca0dcc07d562a6befc4172380

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:RansomwareTest6
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/311589/

Comments