MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bdb7a98c650426ff70b666a8a1f28b421a6135e729a70baf87a5c126fbd788a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 8


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bdb7a98c650426ff70b666a8a1f28b421a6135e729a70baf87a5c126fbd788a
SHA3-384 hash: 51a9190676c2f9578d82a4993d715d55e0202737c78bdfbc29584d02566646cd37b5662f3961d71eccd972eb6d16d549
SHA1 hash: 47c02c198ba3fcdc51b9fbd89a509a83f1e48b38
MD5 hash: 3c541941aa60ce757626f3c7ef08ae6b
humanhash: michigan-wolfram-uranus-vermont
File name:3c541941aa60ce757626f3c7ef08ae6b.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:626'176 bytes
First seen:2021-04-08 16:56:45 UTC
Last seen:2021-04-08 19:44:05 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 376fa88e139eef85f4524a21edf65c38 (1 x CryptBot)
ssdeep 12288:uve4l6qdV21eg2IExcYDI+b1bf6JxcPKOaaJ/YGfnXLK84LI:yeA6G2sCExX5bZfcxcaaJ/v2PLI
Threatray 126 similar samples on MalwareBazaar
TLSH DFD412203A91D033E5B22870AC66C2B0517FBD726B99C1C7B7597F2EAAB01E15E31707
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3c541941aa60ce757626f3c7ef08ae6b.exe
Verdict:
Malicious activity
Analysis date:
2021-04-08 17:17:59 UTC
Tags:
stealer trojan
Link:
https://app.any.run/tasks/731e22fd-376c-4525-afd8-d8ee28e8fb43

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133279/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.14087.26782.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Deleting a recently created file
Creating a file
Delayed reading of the file
Reading critical registry keys
Creating a window
DNS request
Connection attempt
Sending an HTTP POST request
Stealing user critical data
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/670569
Signature
Antivirus detection for URL or domain
Contains functionality to register a low level keyboard hook
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 384228 Sample: 3vQD6TIYA1.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 93 Malicious sample detected (through community Yara rule) 2->93 95 Antivirus detection for URL or domain 2->95 97 Multi AV Scanner detection for dropped file 2->97 99 9 other signatures 2->99 12 3vQD6TIYA1.exe 50 2->12         started        17 SmartClock.exe 2->17         started        19 SmartClock.exe 2->19         started        process3 dnsIp4 87 dyqtl42.top 34.118.72.185, 49738, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 12->87 89 estjh05.top 34.65.214.4, 49740, 49741, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 12->89 91 martlg04.top 8.209.67.151, 49739, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 12->91 71 C:\Users\user\AppData\Local\...\Ikrapsor.exe, PE32 12->71 dropped 73 C:\Users\user\AppData\Local\...\lv[1].exe, PE32 12->73 dropped 121 Detected unpacking (changes PE section rights) 12->121 123 Detected unpacking (overwrites its own PE header) 12->123 125 Tries to harvest and steal browser information (history, passwords, etc) 12->125 21 Ikrapsor.exe 19 12->21         started        25 cmd.exe 1 12->25         started        file5 signatures6 process7 file8 63 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 21->63 dropped 65 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 21->65 dropped 67 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 21->67 dropped 101 Multi AV Scanner detection for dropped file 21->101 103 Machine Learning detection for dropped file 21->103 27 vpn.exe 7 21->27         started        29 4.exe 4 21->29         started        105 Submitted sample is a known malware sample 25->105 107 Obfuscated command line found 25->107 109 Uses ping.exe to sleep 25->109 111 Uses ping.exe to check the status of other devices and networks 25->111 32 conhost.exe 25->32         started        34 timeout.exe 1 25->34         started        signatures9 process10 file11 36 cmd.exe 1 27->36         started        38 dllhost.exe 27->38         started        75 C:\Users\user\AppData\...\SmartClock.exe, PE32 29->75 dropped 40 SmartClock.exe 29->40         started        process12 process13 42 cmd.exe 3 36->42         started        45 conhost.exe 36->45         started        signatures14 113 Obfuscated command line found 42->113 115 Uses ping.exe to sleep 42->115 47 Osato.exe.com 42->47         started        50 PING.EXE 42->50         started        53 findstr.exe 1 42->53         started        process15 dnsIp16 127 May check the online IP address of the machine 47->127 56 Osato.exe.com 47->56         started        77 127.0.0.1 unknown unknown 50->77 69 C:\Users\user\AppData\...\Osato.exe.com, Targa 53->69 dropped file17 signatures18 process19 dnsIp20 79 ip-api.com 208.95.112.1, 49746, 80 TUT-ASUS United States 56->79 81 192.168.2.1 unknown unknown 56->81 83 ntEcUNaDbasrbEJM.ntEcUNaDbasrbEJM 56->83 59 wscript.exe 56->59         started        process21 dnsIp22 85 iplogger.org 88.99.66.31, 443, 49747 HETZNER-ASDE Germany 59->85 117 System process connects to network (likely due to code injection or exploit) 59->117 119 May check the online IP address of the machine 59->119 signatures23
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0bdb7a98c650426ff70b666a8a1f28b421a6135e729a70baf87a5c126fbd788a/
Threat name:
Win32.Spyware.Kiosk
Create hunting rule
Status:
Suspicious
First seen:
2021-04-08 16:57:07 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bpnxvgggkbbg75ylmzviuhziwqq2me26oknhboxypjobe355pcfa._file
Verdict:
suspicious
Similar samples:
10c0f1080840ab3cf7fd69f80a6b821a6f95cb7b57a7e43dfb757e9df598c18a
CryptBot
135df51a2c255ab6c3614bc8ed4a32fdffbdf149e1f290bd845f08d8b77ec39a
CryptBot
26e294b557033c04b7a9039b6e2ef1ec35f8c3ec1a06be3d7b73ddd3ff10395c
CryptBot
39a27d15f3d6175331a974825a440d7475187bae0c133a48a1a5155b49a82537
CryptBot
7bc379fd5f28ca0016ae282820d517d7719cad2742a22968cc3c9d3434ff469d
CryptBot
7c902b5da243bec90b83e4d68e4e8c097d1e36e9d9508c5095023f801440d977
CryptBot
80d4bc601ab1473cb21fc90f190ef7c00ffaa44705c170e6b01bac62eb7c7fd3
CryptBot
941d3312f126a5104966af87ce58d9be63bbaf63216723508d9dd2d2f241fea7
CryptBot
e784ba83c1139d2d9880a2cd5546d1d7716694452ea84367fa9c238f97d5e5ad
CryptBot
ec7db23abe0578993c032c1c962db58d72bc1cdcb8401d33e60e92f784defb75
CryptBot
+ 116 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/210408-5yzrxaw3h2/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies registry class
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
072189f03517f5036c0b3f26da3afe47eea2aca90ee592d4321bc16dcb3d8de2
MD5 hash:
890e9dffaeba2c68be3fbad0bd4b8c01
SHA1 hash:
f2030433a83d87dba5f21fd5066570bb2a1b50f2
Link:
https://www.unpac.me/results/fc8192e5-3d47-4509-b06a-de5b4b3f251d/
SH256 hash:
0bdb7a98c650426ff70b666a8a1f28b421a6135e729a70baf87a5c126fbd788a
MD5 hash:
3c541941aa60ce757626f3c7ef08ae6b
SHA1 hash:
47c02c198ba3fcdc51b9fbd89a509a83f1e48b38
Link:
https://www.unpac.me/results/fc8192e5-3d47-4509-b06a-de5b4b3f251d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0bdb7a98c650426ff70b666a8a1f28b421a6135e729a70baf87a5c126fbd788a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe 0bdb7a98c650426ff70b666a8a1f28b421a6135e729a70baf87a5c126fbd788a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1104406/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/133279/

Comments