MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 118f24dab3dce4a5ae6e3ab078551cbc628b475abeeafa07a5972622aaa38812. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 118f24dab3dce4a5ae6e3ab078551cbc628b475abeeafa07a5972622aaa38812
SHA3-384 hash: 1d88a97b4edd0965b2be24bb64c01aed97b847834b3e9c540fff0dd9d64f444db87c04f38d14b60c0b02b7bfdaa14bb8
SHA1 hash: 367d5ff6ee971fcac30cf8b453eea8f47a936264
MD5 hash: 6f5b1279d943e548259d62f00650044a
humanhash: foxtrot-sink-high-orange
File name:6f5b1279d943e548259d62f00650044a.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:718'848 bytes
First seen:2021-03-22 19:55:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d36455d855d7b912e16160f2813cb3f8 (2 x ArkeiStealer, 1 x RaccoonStealer, 1 x CryptBot)
ssdeep 12288:FG5trS9+YgIJF2X+48su5J3ngpp+WjOCev3R8+x:F8rS9+YgIJF2X+48sM3nOjzD
Threatray 76 similar samples on MalwareBazaar
TLSH D8E4011572E1C072E1E369325A38C7B55E777872283AE94EAB801B790F367D0D66630F
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f400dab915cf4b65ce4a277f93b1fc7b.exe
Verdict:
Malicious activity
Analysis date:
2021-03-22 17:43:05 UTC
Tags:
evasion loader trojan stealer
Link:
https://app.any.run/tasks/d1159043-b6d0-44bd-bbb8-8aa4d0bd19b3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/126202/
Detection(s):
Win.Malware.Generic-9846132-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Launching a process
Launching cmd.exe command interpreter
Creating a file in the %temp% directory
Sending a UDP request
Deleting a recently created file
Creating a file
Delayed reading of the file
Reading critical registry keys
Creating a window
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Creating a process from a recently created file
Stealing user critical data
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/648575
Signature
Antivirus detection for dropped file
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Suspicious Svchost Process
Submitted sample is a known malware sample
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 373252 Sample: zpQP4reqMf.exe Startdate: 22/03/2021 Architecture: WINDOWS Score: 100 91 foFLdQgDGpIYYlT.foFLdQgDGpIYYlT 2->91 93 JuStzaVJxTdWqqF.JuStzaVJxTdWqqF 2->93 95 iplogger.org 2->95 109 Malicious sample detected (through community Yara rule) 2->109 111 Antivirus detection for dropped file 2->111 113 Multi AV Scanner detection for dropped file 2->113 115 10 other signatures 2->115 11 zpQP4reqMf.exe 50 2->11         started        16 SmartClock.exe 2->16         started        18 SmartClock.exe 2->18         started        signatures3 process4 dnsIp5 101 mormsd01.top 193.38.55.157, 49750, 80 SERVERIUS-ASNL Russian Federation 11->101 103 akmes01.top 47.254.173.53, 49751, 49752, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC United States 11->103 105 2 other IPs or domains 11->105 87 C:\Users\user\AppData\Local\Temp\Skinks.exe, PE32 11->87 dropped 89 C:\Users\user\AppData\Local\...\lv[1].exe, PE32 11->89 dropped 135 Detected unpacking (changes PE section rights) 11->135 137 Detected unpacking (overwrites its own PE header) 11->137 139 Tries to harvest and steal browser information (history, passwords, etc) 11->139 20 Skinks.exe 21 11->20         started        24 cmd.exe 1 11->24         started        file6 signatures7 process8 file9 71 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 20->71 dropped 73 C:\Users\user\AppData\Local\Temp\...\6.exe, PE32 20->73 dropped 75 C:\Users\user\AppData\Local\Temp\...\5.exe, PE32+ 20->75 dropped 77 2 other files (1 malicious) 20->77 dropped 121 Machine Learning detection for dropped file 20->121 26 5.exe 181 20->26         started        31 6.exe 7 20->31         started        33 vpn.exe 7 20->33         started        35 4.exe 4 20->35         started        123 Submitted sample is a known malware sample 24->123 125 Obfuscated command line found 24->125 127 Uses ping.exe to sleep 24->127 129 Uses ping.exe to check the status of other devices and networks 24->129 37 conhost.exe 24->37         started        39 timeout.exe 1 24->39         started        signatures10 process11 dnsIp12 97 googlehosted.l.googleusercontent.com 172.217.23.33, 443, 49755 GOOGLEUS United States 26->97 99 doc-04-04-docs.googleusercontent.com 26->99 79 C:\Users\user\AppData\...\WinRing0x64.sys, PE32+ 26->79 dropped 81 C:\Users\user\AppData\Local\...\Active.exe, PE32+ 26->81 dropped 83 C:\Users\user\AppData\...\AutoIt3_x64.exe, PE32+ 26->83 dropped 131 Query firmware table information (likely to detect VMs) 26->131 133 Sample is not signed and drops a device driver 26->133 41 cmd.exe 31->41         started        43 svchost.exe 31->43         started        45 cmd.exe 33->45         started        47 svchost.exe 33->47         started        85 C:\Users\user\AppData\...\SmartClock.exe, PE32 35->85 dropped 49 SmartClock.exe 35->49         started        file13 signatures14 process15 process16 51 cmd.exe 41->51         started        54 conhost.exe 41->54         started        56 cmd.exe 45->56         started        58 conhost.exe 45->58         started        signatures17 117 Obfuscated command line found 51->117 119 Uses ping.exe to sleep 51->119 60 PING.EXE 51->60         started        63 findstr.exe 51->63         started        65 Allora.exe.com 51->65         started        67 findstr.exe 56->67         started        69 Dimmi.exe.com 56->69         started        process18 dnsIp19 107 127.0.0.1 unknown unknown 60->107
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/118f24dab3dce4a5ae6e3ab078551cbc628b475abeeafa07a5972622aaa38812/
Threat name:
Win32.Spyware.Caynamer
Create hunting rule
Status:
Malicious
First seen:
2021-03-22 10:44:12 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
25 of 29 (86.21%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cghsjwvt3tsklltohkyhqvi4xrriwr22x3vpub5fs4tcfkvdraja._file
Verdict:
suspicious
Similar samples:
2c2d88dbff1f9196148cc3c7501d4c45b05ef51887651b3bcdbb111fcc7a2ba2
CryptBot
388d18b98704bff34ac1cb0a6603e68ba300205ee2f14e4bf482f1012d933231
CryptBot
7bc379fd5f28ca0016ae282820d517d7719cad2742a22968cc3c9d3434ff469d
CryptBot
8cec146d7a7b594cf7748b35c63ea1fed2c994ef2cdbb5731f1b15d9c9fa1ee3
CryptBot
9cda1177646d0a69217e80541b33a93f1343a3406729fd09fb19a19808cfed4b
CryptBot
b0e796694c790548cf9553a6ed536b21e8471064c4ae887304137ffcafbe257f
CryptBot
b31544541ebcdaeb7746d400b534e0ce49abb44d5922acacaa1653c492cbd650
CryptBot
bced04a0ef9306f81abe9dcd2bf613802076f1d2012f23bcc42a208acabf25dd
CryptBot
c8a30abef2939b6c3b6193feffbaf8ba4a87c79fc32e71b10b94bbdb8e1e238f
CryptBot
e784ba83c1139d2d9880a2cd5546d1d7716694452ea84367fa9c238f97d5e5ad
CryptBot
+ 66 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:cryptbot family:xmrig discovery evasion miner spyware stealer upx
Link:
https://tria.ge/reports/210322-gmbkca9wn6/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
Sets file to hidden
UPX packed file
XMRig Miner Payload
CryptBot
xmrig
Unpacked files
SH256 hash:
69cd9ef1104aefbae4f68bb7915c928a061bfa55b97fe0ce4845ce3c9fe49775
MD5 hash:
162b035cfcd67632a60689aea7dfe19a
SHA1 hash:
4cfab454869214944b4f7c62dfbf879e96dc9fb2
Link:
https://www.unpac.me/results/79b18b58-5ab1-4817-9c8b-d78050aa9d33/
SH256 hash:
118f24dab3dce4a5ae6e3ab078551cbc628b475abeeafa07a5972622aaa38812
MD5 hash:
6f5b1279d943e548259d62f00650044a
SHA1 hash:
367d5ff6ee971fcac30cf8b453eea8f47a936264
Link:
https://www.unpac.me/results/79b18b58-5ab1-4817-9c8b-d78050aa9d33/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/118f24dab3dce4a5ae6e3ab078551cbc628b475abeeafa07a5972622aaa38812

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe 118f24dab3dce4a5ae6e3ab078551cbc628b475abeeafa07a5972622aaa38812

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1083190/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/126202/

Comments