MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21c551ed1ce186d015c2fc69268f9243652c24a4fc4a37b1fecf799a3b89e063. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21c551ed1ce186d015c2fc69268f9243652c24a4fc4a37b1fecf799a3b89e063
SHA3-384 hash: 830a52a3747c0cf11683d64b4251605457c9e85e4e23b4cd6aeaa94e24035324454d84f87acb4ea7643a6fa888be0c95
SHA1 hash: a321e785279754cdf0bb21b30946755c5bed6655
MD5 hash: 1fa0dc2ac5e6610b1f19c2afd119e9fe
humanhash: whiskey-edward-wolfram-twenty
File name:1fa0dc2ac5e6610b1f19c2afd119e9fe.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:641'024 bytes
First seen:2021-03-19 14:23:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0329daedf7410b851c763de6fe05fcee (1 x RaccoonStealer, 1 x CryptBot)
ssdeep 12288:Kp93fTnoTNmp1uJpS90TttHWaF/GXKqxpUPmFoJXC3cTG0QPgo61mE:e9rahJ2OtVTFO6wpUuFYC308p
Threatray 4 similar samples on MalwareBazaar
TLSH 98D4125176C0C473E15A05B68C11C7B88B76FC7A0B2053D7BB806B6D5F392E28A3A74B
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
235
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1fa0dc2ac5e6610b1f19c2afd119e9fe.exe
Verdict:
Malicious activity
Analysis date:
2021-03-19 14:26:21 UTC
Tags:
stealer trojan loader
Link:
https://app.any.run/tasks/f6c211bb-5e7e-46b4-a432-0e302ae83cdf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/125663/
Detection(s):
Win.Malware.Generic-9845437-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Deleting a recently created file
Creating a file
Delayed reading of the file
Reading critical registry keys
Creating a window
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Launching a process
Launching cmd.exe command interpreter
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CryptBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/507856f1-930f-4f76-8233-671866d6a0fd
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/646214
Signature
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 372098 Sample: 3UiiwuZ4YR.exe Startdate: 19/03/2021 Architecture: WINDOWS Score: 100 84 fGemUlcMhTSJ.fGemUlcMhTSJ 2->84 98 Malicious sample detected (through community Yara rule) 2->98 100 Multi AV Scanner detection for dropped file 2->100 102 Multi AV Scanner detection for submitted file 2->102 104 6 other signatures 2->104 12 3UiiwuZ4YR.exe 50 2->12         started        17 SmartClock.exe 2->17         started        19 SmartClock.exe 2->19         started        signatures3 process4 dnsIp5 90 deodd52.top 34.89.220.179, 49733, 80 GOOGLEUS United States 12->90 92 pilwec03.top 35.246.158.152, 49740, 49741, 80 GOOGLEUS United States 12->92 94 morbyj05.top 95.142.44.135, 49734, 80 EUROBYTEEurobyteLLCMoscowRussiaRU Russian Federation 12->94 80 C:\Users\user\AppData\Local\...\Marusya.exe, PE32 12->80 dropped 82 C:\Users\user\AppData\Local\...\lv[1].exe, PE32 12->82 dropped 122 Detected unpacking (changes PE section rights) 12->122 124 Detected unpacking (overwrites its own PE header) 12->124 126 Tries to harvest and steal browser information (history, passwords, etc) 12->126 21 Marusya.exe 20 12->21         started        25 cmd.exe 1 12->25         started        file6 signatures7 process8 file9 72 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 21->72 dropped 74 C:\Users\user\AppData\Local\Temp\...\6.exe, PE32 21->74 dropped 76 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 21->76 dropped 78 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 21->78 dropped 106 Multi AV Scanner detection for dropped file 21->106 108 Machine Learning detection for dropped file 21->108 27 6.exe 8 21->27         started        29 vpn.exe 8 21->29         started        31 4.exe 4 21->31         started        110 Submitted sample is a known malware sample 25->110 112 Obfuscated command line found 25->112 114 Uses ping.exe to sleep 25->114 116 Uses ping.exe to check the status of other devices and networks 25->116 35 conhost.exe 25->35         started        37 timeout.exe 1 25->37         started        signatures10 process11 dnsIp12 39 cmd.exe 1 27->39         started        41 cmd.exe 1 29->41         started        96 192.168.2.1 unknown unknown 31->96 70 C:\Users\user\AppData\...\SmartClock.exe, PE32 31->70 dropped 43 SmartClock.exe 31->43         started        file13 process14 process15 45 cmd.exe 3 39->45         started        48 conhost.exe 39->48         started        50 cmd.exe 3 41->50         started        52 conhost.exe 41->52         started        signatures16 118 Obfuscated command line found 45->118 120 Uses ping.exe to sleep 45->120 54 PING.EXE 45->54         started        57 Accostarmi.exe.com 45->57         started        59 findstr.exe 45->59         started        61 findstr.exe 50->61         started        63 Cadere.exe.com 50->63         started        65 PING.EXE 50->65         started        process17 dnsIp18 88 127.0.0.1 unknown unknown 54->88 67 Accostarmi.exe.com 57->67         started        process19 dnsIp20 86 QtmMJaPrjoHf.QtmMJaPrjoHf 67->86
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21c551ed1ce186d015c2fc69268f9243652c24a4fc4a37b1fecf799a3b89e063/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-03-19 14:24:09 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ehcvd3i44gdnafoc7rusnd4sinssyjfe7rfdpmp6z54zuo4j4brq._file
Verdict:
suspicious
Similar samples:
029a8669597543f16beacbcd8fd0eedb0e2ea51a401e5d88bbbe4ef0d0c410c8
CryptBot
36f82bc3bcd30f18bb210cd10881cfe13e9a22e06e26930828bb6c8a951bfafe
CryptBot
38b951946943714900dc29bb01ce025a84e0f52f095e2901e74a509b9499f2c6
CryptBot
fc2a8472021c1f37e7ba14fd51259d37d10bd030ecd33134ebf42d3279ab860a
CryptBot
Result
Malware family:
cryptbot
Create hunting rule
Score:
  10/10
Tags:
family:cryptbot discovery spyware stealer
Link:
https://tria.ge/reports/210319-tc8slyld16/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
CryptBot
Unpacked files
SH256 hash:
60b684d6d6760653cf8ff6ca80f620e0b951b2cec9a864a3e1d54df2cc8ac2f3
MD5 hash:
f05aee16bb81952807c8fe99f0f2cd97
SHA1 hash:
300963f7d8bc05d6d8dd42a0a9ac7086be5af94a
Link:
https://www.unpac.me/results/78c08519-4f60-4d23-83e9-027f0afac86d/
SH256 hash:
21c551ed1ce186d015c2fc69268f9243652c24a4fc4a37b1fecf799a3b89e063
MD5 hash:
1fa0dc2ac5e6610b1f19c2afd119e9fe
SHA1 hash:
a321e785279754cdf0bb21b30946755c5bed6655
Link:
https://www.unpac.me/results/78c08519-4f60-4d23-83e9-027f0afac86d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/21c551ed1ce186d015c2fc69268f9243652c24a4fc4a37b1fecf799a3b89e063

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe 21c551ed1ce186d015c2fc69268f9243652c24a4fc4a37b1fecf799a3b89e063

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1075272/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/125663/

Comments