MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b371bd339b7bb8fdab7ad80e9a563ebb17d6722c7d08dca5cfc19dad62d00e87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

PhoenixKeylogger

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	b371bd339b7bb8fdab7ad80e9a563ebb17d6722c7d08dca5cfc19dad62d00e87
SHA3-384 hash:	6f04d9e468f325e9ac50fd0b36e2ca3a5da7e5801ce35e31b2268bb6bdc275dbc34e7b4a4b19a6f2cdf0534fce494de0
SHA1 hash:	5dbb68abd9ce55a8ff99eee4ca047b83aa3106bf
MD5 hash:	da1578d55d9f171e52ef19ea2c25aff2
humanhash:	utah-foxtrot-moon-angel
File name:	DHL Delivery Reciept.exe
Download:	download sample
Signature	PhoenixKeylogger Create hunting rule
File size:	709'632 bytes
First seen:	2020-08-19 13:39:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7c7e091463597fc93148f9bbc0ede2b8 (4 x Loki, 2 x Formbook, 1 x AZORult)
ssdeep	12288:CRsEB+1sK7zsg+ZvBI2pgQjpUtX8moeDCsEp6la8hwF1pZdEQ2YJ8Pm:CjIB/sg+ZcQdg8bm5lGDUHPm
Threatray	2'245 similar samples on MalwareBazaar
TLSH	51E47D22BDD04437C1721A789D2BB7679C29BDD0EA2868466BF4DD0C8F396D13939393
Reporter	abuse_ch
Tags:	DHL exe PhoenixKeylogger

abuse_ch

Malspam distributing unidentified malware:

HELO: xzn0.722.metalvxini.ga
Sending IP: 178.62.200.135
From: DHL QUERY <dhaquery@dhl.com>
Subject: DHL: Urgent:Delivery Receipt Wrong delivery Address Report
Attachment: DHL Delivery Reciept.arj (contains "DHL Delivery Reciept.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Phoenix

Link:

https://www.capesandbox.com/analysis/48574/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a file

Connection attempt

Sending a UDP request

Result

Threat name:

404Keylogger AgentTesla

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/438252

Signature

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

May check the online IP address of the machine

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Yara detected 404Keylogger

Yara detected AgentTesla

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b371bd339b7bb8fdab7ad80e9a563ebb17d6722c7d08dca5cfc19dad62d00e87/

Threat name:

Win32.Infostealer.CoinStealer

Status:

Malicious

First seen:

2020-08-18 23:33:27 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wny32m43po4p3k323ahjuvr6xml5m4rmpuenzjopygo22ywqb2dq._file

Verdict:

malicious

Label(s):

hawkeyekeylogger

PhoenixKeylogger

121cba7566201217f8725044bc4e51283b873305c5e84b9e1623313cefa5fe4b

PhoenixKeylogger

482c86b2e6323b9d41b0692af170ac5241998c15bbb486ed2bab2e60a6841c10

PhoenixKeylogger

65a226dbf2cb9d30ad397117199260d3b8989e99c01de03a0d4f8eb0622794fc

PhoenixKeylogger

7cef313bae579b3735126139266cd34225fc71e2a38b83ad6e69ba703b71d85e

PhoenixKeylogger

8243c8a72e7a2021b4d956f5dafc19ded0162e9eb99f158f8da83660ea9368b5

PhoenixKeylogger

8f746ab02591cecc45226d28bf483dff6616f697c1d79f8d1daddd5e8ba1d764

PhoenixKeylogger

a3404371c1e25bd9c4b541eba9802998efc98d7754175cd01ef351793c8c9cca

PhoenixKeylogger

a4d946657a2d74c1f84a53cb0f42d22feffad6720044f926c743ac787ca30b16

PhoenixKeylogger

eacb842bfb2638dad0dfc194ecf323a019780a3ab3be7f2f21e2a0d5726156f2

PhoenixKeylogger

+ 2'235 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

upx spyware

Link:

https://tria.ge/reports/200819-fkp2slf7ze/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Looks up external IP address via web service

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

UPX packed file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Lokibot

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b371bd339b7bb8fdab7ad80e9a563ebb17d6722c7d08dca5cfc19dad62d00e87

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	MAL_Envrial_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Encrial credential stealer malware
Reference:	https://twitter.com/malwrhunterteam/status/953313514629853184