MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca8c047625f5cf6483de7787327e9728efbc3cdfabff58ca623a2966f5c15600. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XehookStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 3 File information Comments 1

SHA256 hash:	ca8c047625f5cf6483de7787327e9728efbc3cdfabff58ca623a2966f5c15600
SHA3-384 hash:	f7ed72891a6921f1ba2a2b9e9cde23ff2113adbb157f478df758a51495181bc1662c84ac2b9cb9caf0e8171d448637a6
SHA1 hash:	85137de6a39adaea4593bdeb7145ad55a578b397
MD5 hash:	d1ec6dbbe13ed8451b267702350c12c6
humanhash:	freddie-hot-lamp-lake
File name:	d1ec6dbbe13ed8451b267702350c12c6
Download:	download sample
Signature	XehookStealer Create hunting rule
File size:	321'536 bytes
First seen:	2024-05-20 04:10:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	65f8d3b7633d5a017c9f24a26c67363d (2 x XehookStealer, 2 x LummaStealer, 1 x RedLineStealer)
ssdeep	6144:+68xYCR6hv9DonM3v6nNTzXvf0ru+UePpzJfww7TR5Me9a6n:T8xYCS6nxf0r3UqBJJ5TFn
TLSH	T1BC64CF1175C08072D67315364AF0DBB45A7EF9704B629ECF73940ABE4F342D1EA21AAA
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter	zbetcheckin
Tags:	32 exe XehookStealer

Intelligence

File Origin

# of uploads :

# of downloads :

516

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ca8c047625f5cf6483de7787327e9728efbc3cdfabff58ca623a2966f5c15600.exe

Verdict:

Malicious activity

Analysis date:

2024-05-20 04:13:42 UTC

Tags:

evasion phemedrone stealer

Link:

https://app.any.run/tasks/f6568804-0434-4b0d-a994-f1924cdc0424

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.PWSX-gen.26837.29679.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Launching a process

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Creating a file

Reading critical registry keys

Using the Windows Management Instrumentation requests

Creating a window

Sending an HTTP GET request

Creating a file in the %temp% directory

Running batch commands

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

crypto fingerprint packed

Link:

https://www.filescan.io/uploads/664acd583313f70f0affee04/reports/ba2c1cab-d74c-4c2c-bd87-df894707c304/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/ca8c047625f5cf6483de7787327e9728efbc3cdfabff58ca623a2966f5c15600

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f74f8c96-1483-489b-b660-c8d2815b6753

Result

Threat name:

Xehook Stealer

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1444103

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

Contains functionality to inject code into remote processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Writes to foreign memory regions

Yara detected Xehook Stealer

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/ca8c047625f5cf6483de7787327e9728efbc3cdfabff58ca623a2966f5c15600

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ca8c047625f5cf6483de7787327e9728efbc3cdfabff58ca623a2966f5c15600/

Threat name:

Win32.Trojan.Malgent

Status:

Malicious

First seen:

2024-05-19 04:35:28 UTC

File Type:

PE (Exe)

AV detection:

23 of 24 (95.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zkgai5rf6xhwja66o6dte7uxfdx3ypg7vp7vrstchiuwn5obkyaa._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

7/10

Tags:

spyware stealer

Link:

https://tria.ge/reports/240520-eryfnabg2y/

Behaviour

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Looks up external IP address via web service

Checks computer location settings

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/11f7e551-0f78-41fc-b0a4-ee77a1f62b5e

Unpacked files

SH256 hash:

72e0123ed6fce92ac6a4ea90f73729e102c2cc303a78a5308d54781e5f573e73

MD5 hash:

4fadfed458115ba8a654c20a203eb613

SHA1 hash:

e441ae598b392fea4caae14f4d33b954060e8dd2

Detections:

INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

INDICATOR_EXE_Packed_ConfuserEx

INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs

INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Link:

https://www.unpac.me/results/86c5eb91-a251-412b-b4db-7da6637d41ce/

SH256 hash:

ca8c047625f5cf6483de7787327e9728efbc3cdfabff58ca623a2966f5c15600

MD5 hash:

d1ec6dbbe13ed8451b267702350c12c6

SHA1 hash:

85137de6a39adaea4593bdeb7145ad55a578b397

Link:

https://www.unpac.me/results/86c5eb91-a251-412b-b4db-7da6637d41ce/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ca8c047625f5cf6483de7787327e9728efbc3cdfabff58ca623a2966f5c15600

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

XehookStealer

exe ca8c047625f5cf6483de7787327e9728efbc3cdfabff58ca623a2966f5c15600

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2856324/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateRemoteThread KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileW
WIN_CRYPT_API	Uses Windows Crypt API	ADVAPI32.dll::CryptDecrypt

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-05-20 04:10:44 UTC

url : hxxp://5.42.96.7/lend/123.exe