MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae0087b0e2f4292c64c5232368e562c30da4db998734b9b3dd5e27f456741f9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SystemBC

Vendor detections: 13

Intelligence 13 IOCs YARA File information Comments 1

SHA256 hash:	ae0087b0e2f4292c64c5232368e562c30da4db998734b9b3dd5e27f456741f9c
SHA3-384 hash:	31359c0a29af864dcb98d0979cf30d1c23c7f1d59a65a21bbbadc95417d8905cc05e3b26c307e2d028918229a1465a75
SHA1 hash:	ad89006d5c3938c544d3c6ee648f2fc25eeac556
MD5 hash:	dc80d05184fe7f0757caefa3d0c96682
humanhash:	mike-mississippi-gee-washington
File name:	dc80d05184fe7f0757caefa3d0c96682
Download:	download sample
Signature	SystemBC Create hunting rule
File size:	383'488 bytes
First seen:	2023-07-14 07:20:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c6b23c9c77136c0217965b910816add2 (4 x RedLineStealer, 2 x SystemBC, 1 x Amadey)
ssdeep	6144:eLw4/9ZyRhBb1Z4HAp+KcvsWxTrwc/ysETGdpxLt4cCt:es+yLBKAp+rnwcEAD54j
Threatray	414 similar samples on MalwareBazaar
TLSH	T1F2840231BDA0C175D1ABC2345C75C724BE7F7052AB75C4C723A89A6F2E702C296BA352
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	020405030e283000 (1 x SystemBC)
Reporter	zbetcheckin
Tags:	32 exe SystemBC

Intelligence

File Origin

# of uploads :

# of downloads :

293

Origin country :

Vendor Threat Intelligence

Malware family:

smoke

ID:

File name:

dc80d05184fe7f0757caefa3d0c96682

Verdict:

Malicious activity

Analysis date:

2023-07-14 07:23:55 UTC

Tags:

loader smoke trojan ransomware

Link:

https://app.any.run/tasks/55fecfb2-6da5-427c-80c2-d6a6f73ec184

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Rhadamanthys

Link:

https://www.capesandbox.com/analysis/418636/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/64b0f76058d62e49a2fdccdc/reports/dddcc0d8-9d59-43e2-a711-1b50f9dc5e13/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/ae0087b0e2f4292c64c5232368e562c30da4db998734b9b3dd5e27f456741f9c

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4d138de5-0278-477f-b8ca-73b356f8613b

Result

Threat name:

Phobos, RHADAMANTHYS, SmokeLoader, Syste

Detection:

malicious

Classification:

rans.troj.adwa.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1272969

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Creates autostart registry keys with suspicious values (likely registry only malware)

Creates files in the recycle bin to hide itself

Creates multiple autostart registry keys

Creates processes via WMI

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Drops PE files to the startup folder

Found evasive API chain (may stop execution after checking mutex)

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes many files with high entropy

Yara detected AntiVM3

Yara detected Phobos

Yara detected RHADAMANTHYS Stealer

Yara detected SmokeLoader

Yara detected SystemBC

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ae0087b0e2f4292c64c5232368e562c30da4db998734b9b3dd5e27f456741f9c/

Threat name:

Win32.Trojan.SmokeLoader

Status:

Malicious

First seen:

2023-07-14 07:09:47 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vyaipmhc6qusyzgfemrwrzlcymg2jw4zq42ltm65lyt7ivtud6oa._file

Verdict:

malicious

Result

Malware family:

systembc

Score:

10/10

Tags:

family:phobos family:rhadamanthys family:smokeloader family:systembc backdoor collection evasion persistence ransomware spyware stealer trojan

Link:

https://tria.ge/reports/230714-h6mt9acf32/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Interacts with shadow copies

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy service COM API

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Program crash

Drops file in Program Files directory

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Drops desktop.ini file(s)

Checks computer location settings

Deletes itself

Drops startup file

Executes dropped EXE

Reads user/profile data of web browsers

Deletes backup catalog

Downloads MZ/PE file

Modifies Windows Firewall

Deletes shadow copies

Modifies boot configuration data using bcdedit

Renames multiple (291) files with added filename extension

Renames multiple (482) files with added filename extension

Detect rhadamanthys stealer shellcode

Phobos

Rhadamanthys

SmokeLoader

Suspicious use of NtCreateUserProcessOtherParentProcess

SystemBC

Malware Config

C2 Extraction:

adstat477d.xyz:4044
demstat577d.xyz:4044
http://serverxlogs21.xyz/statweb255/
http://servxblog79.xyz/statweb255/
http://demblog289.xyz/statweb255/
http://admlogs77x.online/statweb255/
http://blogxstat38.xyz/statweb255/
http://blogxstat25.xyz/statweb255/