MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ba569c631438a0fb356441838ff328835d607e7cdb217cc444923c1ec58337b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ba569c631438a0fb356441838ff328835d607e7cdb217cc444923c1ec58337b
SHA3-384 hash: a7b63d0d95d0cb30efdf6ca13496a5f337606b25e72ef552ec727f5d75b5abfb88b23eb6178ea22f0e6b67f2d7fc4bc6
SHA1 hash: 8f3d44bb3a48a76be53b8e6d227b5dda432ed5b5
MD5 hash: ab3580b5eb547523abf3c29133504c64
humanhash: undress-shade-oregon-beer
File name:ab3580b5eb547523abf3c29133504c64.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:5'534'336 bytes
First seen:2021-01-11 07:46:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep 98304:JZ7uCH9tlp5HyvNoOWup/PFtFdYX9xhxcdnmNAkyYm1EIlf602df2P4+hJMzIJWb:JZ3FXvup/PLzYNrxcxmWFYmC0MUcSG
Threatray 54 similar samples on MalwareBazaar
TLSH E346338216EBE065F6500773ECB17F634AA4B9AB2DFFC661239495CDB42097C9EB0341
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file_new2.exe
Verdict:
Malicious activity
Analysis date:
2021-01-11 00:55:48 UTC
Tags:
stealer trojan loader evasion
Link:
https://app.any.run/tasks/cb975590-800f-487d-a813-0bf97c9ec929

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/111215/
Detection(s):
SecuriteInfo.com.EXE.Obfus-4.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Deleting a recently created file
Searching for analyzing tools
Searching for the window
Creating a file in the %AppData% subdirectories
DNS request
Sending an HTTP GET request
Creating a file
Sending a custom TCP request
Sending a UDP request
Running batch commands
Creating a process with a hidden window
Launching a process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Cryptbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/577657
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Potentially malicious time measurement code found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Yara detected Cryptbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 337882 Sample: I1dO8QkyWW.exe Startdate: 11/01/2021 Architecture: WINDOWS Score: 100 48 Antivirus detection for URL or domain 2->48 50 Antivirus detection for dropped file 2->50 52 Multi AV Scanner detection for dropped file 2->52 54 9 other signatures 2->54 7 I1dO8QkyWW.exe 20 2->7         started        10 SmartClock.exe 2->10         started        13 SmartClock.exe 2->13         started        process3 file4 30 C:\Users\user\AppData\Local\...\vpn_ico.exe, PE32 7->30 dropped 32 C:\Users\user\AppData\Local\...\6_ico.exe, PE32 7->32 dropped 34 C:\Users\user\AppData\Local\...\4_ico.exe, PE32 7->34 dropped 36 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 7->36 dropped 15 4_ico.exe 4 7->15         started        19 vpn_ico.exe 3 19 7->19         started        22 6_ico.exe 3 7->22         started        62 Hides threads from debuggers 10->62 64 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->64 signatures5 process6 dnsIp7 38 C:\Users\user\AppData\...\SmartClock.exe, PE32 15->38 dropped 44 Hides threads from debuggers 15->44 46 Tries to detect sandboxes / dynamic malware analysis system (registry check) 15->46 24 SmartClock.exe 15->24         started        40 ip-api.com 208.95.112.1, 49741, 80 TUT-ASUS United States 19->40 27 wscript.exe 12 19->27         started        file8 signatures9 process10 dnsIp11 56 Hides threads from debuggers 24->56 58 Tries to detect sandboxes / dynamic malware analysis system (registry check) 24->58 42 iplogger.org 88.99.66.31, 443, 49742 HETZNER-ASDE Germany 27->42 60 System process connects to network (likely due to code injection or exploit) 27->60 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ba569c631438a0fb356441838ff328835d607e7cdb217cc444923c1ec58337b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-10 21:47:50 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=doswtrrriofa7m2wiqmdr7zsra25mb7hzwzbptcejer4d3cygn5q._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
57e0906e3b6e13fe8db13cc06ce37d957bfc045afa6e99e9cf8b893ceb57d018
CryptBot
5c7291c8c0c9aae91453faabe543abd6da50a2600ba74cd9fd1faa18a939cd4b
CryptBot
632315695bf3d61c6249ddf215df529aa5459840e1ad75a388c6af06f7acc99c
CryptBot
7d5a92aa5833ef8a52ccdb4c0845f79fbf2f3a1645e7eadd5cab3b03a7eb4b00
CryptBot
ada1c5359c35e6b70c5a2d5533f9d725f86a1e155c8486bfd2941c9b40478ea2
CryptBot
adc220109f73acdd307036a6d14bffa68103a48e2305c3a4f1533aab74d9deb8
CryptBot
b75f742ad569048f45c0898e017dfcc56e1ac7f98c40249a444fc1dad6ebb49c
CryptBot
b87a93613d0004b0d07eb302e75cd7030cb2a4bf466e92cec234e0abd8e6e727
CryptBot
b99887f1364955d2872bedadab15a15a51429ec8aeb111859d50e24a9fd31342
CryptBot
ffb27074c9ab066faecbaa1ad2e2824ba16553f0cf56fc658e62bc137db50c63
CryptBot
+ 44 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery evasion spyware upx
Link:
https://tria.ge/reports/210111-ejedv476k6/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks installed software on the system
Drops desktop.ini file(s)
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Drops startup file
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
UPX packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
4e25e0738386e1f7b976a3e543613c0d6c3e0d5354b0b563169028d7073de29d
MD5 hash:
0bbd30630e0c5d98605f6a1b56f4e87f
SHA1 hash:
2eb9b250e2c01fc5ab322429f11c293fd05a0283
Link:
https://www.unpac.me/results/a88ed7b9-4ac0-4ed7-bfdf-25f736a19180/
SH256 hash:
1ba569c631438a0fb356441838ff328835d607e7cdb217cc444923c1ec58337b
MD5 hash:
ab3580b5eb547523abf3c29133504c64
SHA1 hash:
8f3d44bb3a48a76be53b8e6d227b5dda432ed5b5
Link:
https://www.unpac.me/results/a88ed7b9-4ac0-4ed7-bfdf-25f736a19180/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Barys
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1ba569c631438a0fb356441838ff328835d607e7cdb217cc444923c1ec58337b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe 1ba569c631438a0fb356441838ff328835d607e7cdb217cc444923c1ec58337b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/951753/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/111215/

Comments