MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00dfe1c0275613464fac102cd1d1bf35983038db80455b92be2630fbe9cf040b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00dfe1c0275613464fac102cd1d1bf35983038db80455b92be2630fbe9cf040b
SHA3-384 hash: 2b159e93988906b3ff7f6537ce7f7d1f2c91e36993795a863d4e55cbf5524648a015da1c1f360b73346dcfd0923cff71
SHA1 hash: 6f8a9477cad6a0f66b5e0670d5c9d59529a663ba
MD5 hash: c8fe3c063172abfbdc0f5cab7c9855f1
humanhash: ten-golf-five-lion
File name:c8fe3c063172abfbdc0f5cab7c9855f1.exe
Download: download sample
File size:1'168'488 bytes
First seen:2021-03-09 15:21:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a1a66d588dcf1394354ebf6ec400c223 (49 x RedLineStealer, 7 x CryptBot, 4 x AZORult)
ssdeep 24576:N53uhFG/lHNYyAxGGcafSVtOkR4BKQX69P67Nfrbvdv+2vH:N5+hFG9tU91SVtQX69irbvdZv
Threatray 46 similar samples on MalwareBazaar
TLSH DA4523A12AD000B6C89315737E65A3E959F9DE284B5848D37F3C020EFFE25C5AE3D169
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://crackknow.com/adobe-photoshop-cc-crack-keygen/
Verdict:
Malicious activity
Analysis date:
2021-03-09 13:41:42 UTC
Tags:
opendir autoit stealer trojan evasion loader danabot
Link:
https://app.any.run/tasks/69fa46f7-6ee2-413e-bd46-967be4018afc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/123282/
Detection(s):
PUA.Win.File.Generic-7557964-0
Create hunting rule

SecuriteInfo.com.Artemis8A5D1E11C3D3.26302.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% subdirectories
Running batch commands
Creating a process with a hidden window
Launching cmd.exe command interpreter
Launching a process
Creating a process from a recently created file
Deleting a recently created file
DNS request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Cryptbot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/633060
Signature
Contains functionality to register a low level keyboard hook
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Cryptbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 365507 Sample: bZY7TD9Q8q.exe Startdate: 09/03/2021 Architecture: WINDOWS Score: 72 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected Cryptbot 2->46 48 Obfuscated command line found 2->48 50 2 other signatures 2->50 9 bZY7TD9Q8q.exe 8 2->9         started        process3 signatures4 52 Contains functionality to register a low level keyboard hook 9->52 12 cmd.exe 1 9->12         started        14 cmd.exe 1 9->14         started        process5 signatures6 17 cmd.exe 2 12->17         started        20 conhost.exe 12->20         started        54 Submitted sample is a known malware sample 14->54 22 conhost.exe 14->22         started        process7 signatures8 40 Obfuscated command line found 17->40 42 Uses ping.exe to sleep 17->42 24 PING.EXE 1 17->24         started        27 Momento.com 17->27         started        29 findstr.exe 1 17->29         started        process9 dnsIp10 34 127.0.0.1 unknown unknown 24->34 36 192.168.2.1 unknown unknown 24->36 31 Momento.com 3 27->31         started        process11 dnsIp12 38 QGLyGxuhYAhlFGpLIek.QGLyGxuhYAhlFGpLIek 31->38
Gathering data
Threat name:
Win32.PUA.7zip
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 11:40:35 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  1/5
Verdict:
suspicious
Similar samples:
1c421e6eea0c7d28016da05e2be26a099f94bb355e05ed1088c2098c024760b1
1db0242b6f7de2919880e833801ce2b48bbf83c136235a537b17211e1193d611
2261f624e99b92e00913fd0fc189ae96bb115b3ae5b393e0170066f032b12af1
29c0c875bd961391938a48794be49c006a1ee8c31e25a1fd5f0891f5dcd46e6c
2b9ab52795f34af8e45a80c88ebd53c725bcccdab49aee05a8b848566e8c3b28
3763ca24308739b3916d8c6c76081b7a878aea11d78550b5a7096b93f80e9d60
70a71789d47c49a03c3547aec8ec74aa76c43811aacb2dd43dd455590c11a2cc
94dc4632159764895ff15118dacc7c5b4c3f84722b4ae5c89b9b120adeec92bf
cb04bfdeb1a12eaab0a0442ecdf62ce49d2c1daa5b4345412cf3462b9ab26803
fc2a8472021c1f37e7ba14fd51259d37d10bd030ecd33134ebf42d3279ab860a
+ 36 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
spyware
Link:
https://tria.ge/reports/210309-yegyjzt3ee/
Behaviour
Delays execution with timeout.exe
Runs ping.exe
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
dd375c3ce17e078f86a8cc30a2db413bdaa55688cd1e207cf23407c1d784ea3f
MD5 hash:
1337b794c4b1dc4791aad3518f75f2af
SHA1 hash:
624e13b4132a44081f6ecd4e036c6863b1c7f73a
Link:
https://www.unpac.me/results/c97a4282-bfad-405e-9025-2bd2160d2825/
SH256 hash:
00dfe1c0275613464fac102cd1d1bf35983038db80455b92be2630fbe9cf040b
MD5 hash:
c8fe3c063172abfbdc0f5cab7c9855f1
SHA1 hash:
6f8a9477cad6a0f66b5e0670d5c9d59529a663ba
Link:
https://www.unpac.me/results/c97a4282-bfad-405e-9025-2bd2160d2825/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tnega
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/00dfe1c0275613464fac102cd1d1bf35983038db80455b92be2630fbe9cf040b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 00dfe1c0275613464fac102cd1d1bf35983038db80455b92be2630fbe9cf040b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1056907/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/123282/

Comments