MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc68214ae21bb693cb4dd555bc8eb14fec2d9086da96edbcf8e13bf825c41bce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fc68214ae21bb693cb4dd555bc8eb14fec2d9086da96edbcf8e13bf825c41bce
SHA3-384 hash:	84f81018bcc9ca39cd248029c85e9c7638094e8a97367f3921ea8e965968f2fd05cd48b14c623585d9db0e44da4a4de1
SHA1 hash:	0934d8675790eac367fc6adcc36b36b1baaca73c
MD5 hash:	f901fcc963b6755ffab4030b2c4024b2
humanhash:	cat-skylark-skylark-video
File name:	f901fcc963b6755ffab4030b2c4024b2.exe
Download:	download sample
Signature	Socks5Systemz Alert Create hunting rule
File size:	2'606'080 bytes
First seen:	2023-12-29 15:35:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep	49152:Qq57oyty2n2QT8bAG6bya5z9cNu0dVtG+ZR8LgoDbjTsIcQ8LoxBe/f7O3:vnyfi8kG6+chcxdLxWnjBBeX7O3
TLSH	T17BC533A3A1E842B6E8B6A77254F316CB2771BDE1DD70210B4301965D18F71913E2EB3E
TrID	41.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 22.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 11.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 7.5% (.EXE) Win64 Executable (generic) (10523/12/4) 4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):
dhash icon	f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe Socks5Systemz

abuse_ch

Socks5Systemz C2:
http://5.42.66.57/3886d2276f6914c4.php

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

347

Origin country :

NL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28840.BadO.UNOFFICIAL

Alert

Create hunting rule

Win.Packed.Stealerc-10017072-0

Alert

Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Creating a window

Launching a process

Сreating synchronization primitives

Searching for the browser window

DNS request

Sending a custom TCP request

Searching for the window

Reading critical registry keys

Blocking the Windows Defender launch

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

89%

Tags:

advpack anti-vm CAB control explorer installer lolbin packed rundll32 setupapi sfx shell32

Link:

https://www.filescan.io/uploads/658ee7636b1c2460460ed63e/reports/24af35bc-62eb-4134-a5f7-9c5c0102ebb0/overview

Hybrid Analysis Win/malicious_confidence_90%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/fc68214ae21bb693cb4dd555bc8eb14fec2d9086da96edbcf8e13bf825c41bce

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e97413e8-bb85-4648-aa0f-c72c65056295

Joe Sandbox RisePro Stealer, SmokeLoader, Vidar

Result

Threat name:

RisePro Stealer, SmokeLoader, Vidar

Alert

Create hunting rule

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1368012

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Binary is likely a compiled AutoIt script file

Contains functionality to modify clipboard data

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

GPT-4 Vision identified phishing page

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies Windows Defender protection settings

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

PE file has nameless sections

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Yara detected RisePro Stealer

Yara detected SmokeLoader

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/fc68214ae21bb693cb4dd555bc8eb14fec2d9086da96edbcf8e13bf825c41bce

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fc68214ae21bb693cb4dd555bc8eb14fec2d9086da96edbcf8e13bf825c41bce/

ReversingLabs TitaniumCloud Win32.Spyware.Lummastealer

Threat name:

Win32.Spyware.Lummastealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-29 15:36:11 UTC

File Type:

PE (Exe)

Extracted files:

202

AV detection:

17 of 22 (77.27%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ruccsxcdo3jhs2n2vk3zdvrj7wc3eeg3klo3phy4e57qjoedpha._file

Threatray malicious

Verdict:

malicious

Hatching Triage smokeloader

Result

Malware family:

smokeloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:lumma family:smokeloader backdoor evasion persistence stealer trojan

Link:

https://tria.ge/reports/231229-s1wv3sebfm/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Delays execution with timeout.exe

Modifies Internet Explorer settings

Runs net.exe

Enumerates physical storage devices

Program crash

Launches sc.exe

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Drops startup file

Executes dropped EXE

Loads dropped DLL

Windows security modification

Downloads MZ/PE file

Modifies Windows Firewall

Detect Lumma Stealer payload V4

Lumma Stealer

Modifies Windows Defender Real-time Protection settings

SmokeLoader

Malware Config

C2 Extraction:

http://185.215.113.68/fks/index.php

UnpacMe 2

Unpacked files

SH256 hash:

afc93b6a318aa4ec3a1aeed9c1114800b287b79c62a809887ac1e37ebc9e5106

MD5 hash:

96f93aa9d0db137b8c3fc57aad5685bf

SHA1 hash:

070f4a52fb5bf5a602945a95dd099f324fd3e626

Link:

https://www.unpac.me/results/f95b0f3a-eb4c-45d8-94d3-eab2e92426a2/

SH256 hash:

fc68214ae21bb693cb4dd555bc8eb14fec2d9086da96edbcf8e13bf825c41bce

MD5 hash:

f901fcc963b6755ffab4030b2c4024b2

SHA1 hash:

0934d8675790eac367fc6adcc36b36b1baaca73c

Link:

https://www.unpac.me/results/f95b0f3a-eb4c-45d8-94d3-eab2e92426a2/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fc68214ae21bb693cb4dd555bc8eb14fec2d9086da96edbcf8e13bf825c41bce