MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc9c7d4e3c3e89432102ac84f4399402c9759b1889a5c9f5982a5b50fb17dea9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XFilesStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments 1

SHA256 hash:	cc9c7d4e3c3e89432102ac84f4399402c9759b1889a5c9f5982a5b50fb17dea9
SHA3-384 hash:	1d5b1f2b89b5d280df3d4dc12a28bd9ab8afb7e74cfc18ac3d8da99302757f114c910425d12ee764c25626cd0416706a
SHA1 hash:	2dca13233dfc22bc8be5c6fd4a6a33c56cde251e
MD5 hash:	8b558c047dd8c4866e8d6fbeb1bd4ff3
humanhash:	papa-friend-dakota-carpet
File name:	8b558c047dd8c4866e8d6fbeb1bd4ff3
Download:	download sample
Signature	XFilesStealer Create hunting rule
File size:	5'343'744 bytes
First seen:	2022-07-31 15:07:03 UTC
Last seen:	2022-07-31 16:03:31 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	98304:016IQisqDO3789pqlshyfVB7kmvraxHnPi9/nupkDNcX1j4xADRio2NyWYD:016IQQD8EpqZfV/aVPilu2Dk1j4xADRh
TLSH	T1623633F9DF6E1B0FC1805330685209752519A9E89906EDAFFE0C2BCF62796CD3095BC9
TrID	63.5% (.EXE) Win64 Executable (generic) (10523/12/4) 12.2% (.EXE) OS/2 Executable (generic) (2029/13) 12.0% (.EXE) Generic Win/DOS Executable (2002/3) 12.0% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):
dhash icon	30f0dce4d2d0c502 (1 x N-W0rm, 1 x XFilesStealer)
Reporter	zbetcheckin
Tags:	exe XFilesStealer

Intelligence

File Origin

# of uploads :

# of downloads :

396

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/295386/

Detection(s):

SecuriteInfo.com.BackDoor.SiggenNET.35.22689.9842.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% subdirectories

Launching a process

Creating a file

Sending a custom TCP request

Enabling autorun

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62e69b176fb6aea51f0ebc91/reports/7ce23f6c-6013-4013-8658-13c1d421160d/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/971b32b4-f3a6-4df4-916d-b7e74dc4d37c

Result

Threat name:

Phoenix Miner

Detection:

malicious

Classification:

evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1043808

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Creates an undocumented autostart registry key

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Writes to foreign memory regions

Yara detected Phoenix Miner

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cc9c7d4e3c3e89432102ac84f4399402c9759b1889a5c9f5982a5b50fb17dea9/

Threat name:

ByteCode-MSIL.Trojan.FormBook

Status:

Malicious

First seen:

2022-07-31 15:08:14 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

21 of 26 (80.77%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zsoh2tr4h2eugiicvscpiomualexlgyyrgs4t5myfjnvb6yx32uq._file

Result

Malware family:

n/a

Score:

10/10

Tags:

persistence

Link:

https://tria.ge/reports/220731-shv6tshfar/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Modifies WinLogon for persistence

Unpacked files

SH256 hash:

cc9c7d4e3c3e89432102ac84f4399402c9759b1889a5c9f5982a5b50fb17dea9

MD5 hash:

8b558c047dd8c4866e8d6fbeb1bd4ff3

SHA1 hash:

2dca13233dfc22bc8be5c6fd4a6a33c56cde251e

Link:

https://www.unpac.me/results/189c0511-6e64-43b5-ae19-e8a755ef9cf5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/cc9c7d4e3c3e89432102ac84f4399402c9759b1889a5c9f5982a5b50fb17dea9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.