MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SystemBC


Vendor detections: 15


Intelligence 15 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b
SHA3-384 hash: 0fe578e4e82679bb434e7a23e5bf34e1808c7ec546a62e46136735485d2d2987cbe099980b8bf875a3d95576a3722ccc
SHA1 hash: 583055372661a2a359586a3fc2cdbaecc951659c
MD5 hash: 4a94bfa09b99674b406eefa0fc0f8c5e
humanhash: helium-oxygen-johnny-mars
File name:4a94bfa09b99674b406eefa0fc0f8c5e.exe
Download: download sample
Signature SystemBC
Create hunting rule
File size:520'192 bytes
First seen:2023-09-20 16:54:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:EndeNz+MiYZmsSOgetN5ONjUrhGkOjkLtxOqaF5:EnYNzECS4N5ONjUdGR6POHf
Threatray 269 similar samples on MalwareBazaar
TLSH T186B41207B53A86B1C7289B7FF45622040B98C6766267C71E7D8F536E0C033E6B446A7B
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter abuse_ch
Tags:exe SystemBC

Intelligence

File Origin
# of uploads :
1
# of downloads :
309
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
4a94bfa09b99674b406eefa0fc0f8c5e.exe
Verdict:
Malicious activity
Analysis date:
2023-09-20 16:57:02 UTC
Tags:
rhadamanthys stealer loader ransomware smoke
Link:
https://app.any.run/tasks/5a476b83-ca16-436c-ab1a-1f6a38f27dc2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Rhadamanthys
Create hunting rule
Link:
https://www.capesandbox.com/analysis/450099/
Detection(s):
SecuriteInfo.com.Win32.RATX-gen.20934.23180.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Launching a process
DNS request
Sending an HTTP GET request
Reading critical registry keys
Unauthorized injection to a system process
Stealing user critical data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/650b23e783a0c6425dfaabd7/reports/21953db3-d1bb-4e1f-af21-cc42f5b3e560/overview
Verdict:
Malicious
Labled as:
MSIL.Androm.Generic
Link:
https://www.hybrid-analysis.com/sample/fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/589b011e-cc6d-4367-a8dd-8956ef049890
Result
Threat name:
Phobos, RHADAMANTHYS, SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
rans.spre.troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1311740
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Creates files in the recycle bin to hide itself
Creates files inside the volume driver (system volume information)
Creates processes via WMI
Deletes itself after installation
Deletes shadow drive data (may be related to ransomware)
Deletes the backup plan of Windows
Drops PE files to the startup folder
Found evasive API chain (may stop execution after checking locale)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May disable shadow drive data (uses vssadmin)
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Sigma detected: Delete shadow copy via WMIC
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses bcdedit to modify the Windows boot settings
Uses netsh to modify the Windows network and firewall settings
Writes many files with high entropy
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected Phobos
Yara detected RHADAMANTHYS Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1311740 Sample: PmN7dKYEzn.exe Startdate: 20/09/2023 Architecture: WINDOWS Score: 100 103 servermlogs27.xyz 2->103 139 Found malware configuration 2->139 141 Malicious sample detected (through community Yara rule) 2->141 143 Antivirus detection for URL or domain 2->143 145 13 other signatures 2->145 13 pcY6b48@L.exe 3 2->13         started        16 sg71.exe 3 2->16         started        18 PmN7dKYEzn.exe 3 2->18         started        20 4 other processes 2->20 signatures3 process4 signatures5 171 Antivirus detection for dropped file 13->171 173 Machine Learning detection for dropped file 13->173 175 Drops PE files to the startup folder 13->175 185 2 other signatures 13->185 22 pcY6b48@L.exe 4 13->22         started        177 Injects a PE file into a foreign processes 16->177 24 sg71.exe 16->24         started        179 Performs DNS queries to domains with low reputation 18->179 181 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 18->181 27 PmN7dKYEzn.exe 1 18->27         started        183 Creates files inside the volume driver (system volume information) 20->183 30 uwebuar 20->30         started        process6 dnsIp7 32 pcY6b48@L.exe 2 22->32         started        157 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 24->157 159 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 24->159 161 Maps a DLL or memory area into another process 24->161 35 explorer.exe 24->35 injected 111 amxt25.xyz 45.131.66.61, 49699, 49704, 49705 LOVESERVERSGB Germany 27->111 39 certreq.exe 3 27->39         started        163 Checks if the current machine is a virtual machine (disk enumeration) 30->163 165 Creates a thread in another existing process (thread injection) 30->165 signatures8 process9 dnsIp10 113 Injects a PE file into a foreign processes 32->113 41 pcY6b48@L.exe 1 32->41         started        105 servermlogs27.xyz 45.131.66.120, 49709, 49718, 49719 LOVESERVERSGB Germany 35->105 107 moknex158.xyz 45.131.66.159, 80 LOVESERVERSGB Germany 35->107 87 C:\Users\user\AppData\Roaming\uwebuar, PE32 35->87 dropped 89 C:\Users\user\AppData\Roaming\giiecst, data 35->89 dropped 115 System process connects to network (likely due to code injection or exploit) 35->115 117 Benign windows process drops PE files 35->117 119 Performs DNS queries to domains with low reputation 35->119 127 4 other signatures 35->127 43 pcY6b48@L.exe 35->43         started        46 pcY6b48@L.exe 35->46         started        48 pcY6b48@L.exe 35->48         started        109 amxt25.xyz 39->109 91 C:\Users\user\AppData\Local\...\sg71.exe, PE32 39->91 dropped 93 C:\Users\user\AppData\Local\...\pcY6b48@L.exe, PE32 39->93 dropped 121 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 39->121 123 Tries to steal Mail credentials (via file / registry access) 39->123 125 Tries to harvest and steal browser information (history, passwords, etc) 39->125 129 3 other signatures 39->129 50 conhost.exe 39->50         started        file11 signatures12 process13 signatures14 52 pcY6b48@L.exe 41->52         started        169 Injects a PE file into a foreign processes 43->169 55 pcY6b48@L.exe 43->55         started        57 pcY6b48@L.exe 43->57         started        59 pcY6b48@L.exe 46->59         started        61 pcY6b48@L.exe 48->61         started        process15 signatures16 155 Injects a PE file into a foreign processes 52->155 63 pcY6b48@L.exe 52->63         started        process17 file18 95 Rotate6.ico.id[41D...rexsdata.pro].8base, COM 63->95 dropped 97 C:\Users\user\AppData\...\pcY6b48@L.exe, PE32 63->97 dropped 99 C:\Users\user\AppData\Local\pcY6b48@L.exe, PE32 63->99 dropped 101 95 other malicious files 63->101 dropped 131 Creates files in the recycle bin to hide itself 63->131 133 Creates autostart registry keys with suspicious names 63->133 135 Tries to harvest and steal browser information (history, passwords, etc) 63->135 137 Infects executable files (exe, dll, sys, html) 63->137 67 cmd.exe 63->67         started        70 cmd.exe 63->70         started        signatures19 process20 signatures21 147 May disable shadow drive data (uses vssadmin) 67->147 149 Deletes shadow drive data (may be related to ransomware) 67->149 151 Uses netsh to modify the Windows network and firewall settings 67->151 153 3 other signatures 67->153 72 vssadmin.exe 67->72         started        75 conhost.exe 67->75         started        77 WMIC.exe 67->77         started        85 3 other processes 67->85 79 conhost.exe 70->79         started        81 netsh.exe 70->81         started        83 netsh.exe 70->83         started        process22 signatures23 167 Deletes shadow drive data (may be related to ransomware) 72->167
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b/
Threat name:
ByteCode-MSIL.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2023-09-20 12:52:22 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
23 of 37 (62.16%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7k2ykc3z3yqrxioxrh4auruemv5tu6oijhkgoyo6zmw6swjrcyvq._file
Verdict:
malicious
Similar samples:
29f5a8629986da0b4a353e5423fb39c505cba7c06e7aa4b5a4029c5a1669ae95
SystemBC
62600a3d570dd2096f9eb8bb18b7d4b4844e9c603182529dadad8831f8a067a7
SystemBC
6a14114aa3bebe58ae76c66e7688f77a0e0e031cf048004f6bb670aab6344eeb
SystemBC
8e5f99b92349381fd772b1bdb18cce2c6595181fcad0f68de25593276d61620f
SystemBC
ab3985e07195465b9a9d8c5a9959e783e2a30f6d6e7fdda3ab153de4d7fc6fe6
SystemBC
b45536b641815e8e230c3519ee7b9dcb4bf186ed2f4dc73b4be00066550731aa
SystemBC
+ 259 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:ammyyadmin family:flawedammyy family:phobos family:rhadamanthys family:smokeloader backdoor bootkit collection evasion persistence ransomware rat spyware stealer trojan
Link:
https://tria.ge/reports/230920-ve4d5she5s/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Interacts with shadow copies
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
outlook_office_path
outlook_win_path
Drops file in Program Files directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Drops desktop.ini file(s)
Writes to the Master Boot Record (MBR)
Deletes itself
Drops startup file
Executes dropped EXE
Reads user/profile data of web browsers
Deletes backup catalog
Modifies Windows Firewall
Deletes shadow copies
Modifies boot configuration data using bcdedit
Renames multiple (306) files with added filename extension
Renames multiple (371) files with added filename extension
Ammyy Admin
AmmyyAdmin payload
Detect rhadamanthys stealer shellcode
FlawedAmmyy RAT
Phobos
Rhadamanthys
SmokeLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
http://servermlogs27.xyz/statweb255/
http://servmblog45.xyz/statweb255/
http://demblog575.xyz/statweb255/
http://admlogs85x.xyz/statweb255/
http://blogmstat389.xyz/statweb255/
http://blogmstat255.xyz/statweb255/
Unpacked files
SH256 hash:
fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b
MD5 hash:
4a94bfa09b99674b406eefa0fc0f8c5e
SHA1 hash:
583055372661a2a359586a3fc2cdbaecc951659c
Link:
https://www.unpac.me/results/5b0a9bcb-cb5b-4dcc-bb3d-2828599e9095/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fab5850b79de/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
SystemBC
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BruteSyscallHashes
Create hunting rule
Author:Embee_Research @ Huntress
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_bruteratel_syscall_hashes_oct_2022
Create hunting rule
Author:Embee_Research @ Huntress
Description:Detection of Brute Ratel Badger via api hashes of Nt* functions.
Rule name:win_brute_ratel_c4_w0
Create hunting rule
Author:Embee_Research @ Huntress
Rule name:win_Brute_Syscall_Hashes
Create hunting rule
Author:Embee_Research @ Huntress
Description:Detection of Brute Ratel Badger via api hashes of Nt* functions.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SystemBC

Executable exe fab5850b79de211ba1d789f80a4684657b3a79c849d46761decb2de95931162b

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/450099/
  
URLhaus
https://urlhaus.abuse.ch/url/2703908/
  
Delivery method
Distributed via web download

Comments