MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26e294b557033c04b7a9039b6e2ef1ec35f8c3ec1a06be3d7b73ddd3ff10395c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 8


Intelligence 8 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26e294b557033c04b7a9039b6e2ef1ec35f8c3ec1a06be3d7b73ddd3ff10395c
SHA3-384 hash: d2400b6cd926cbcef3a4b45d917e081cf66b7dcd68fcc2f86194666e1bcaac962acc6bdfc165acf99afd218faf2deefd
SHA1 hash: 1bcdda09f5478cee4aeb66cdd9a33fcb569ee9d0
MD5 hash: 64ebbca7f69233721df621f56d169ed2
humanhash: michigan-tennessee-louisiana-mirror
File name:64ebbca7f69233721df621f56d169ed2.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:608'256 bytes
First seen:2021-04-08 15:45:03 UTC
Last seen:2021-04-08 17:55:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a095dbaf3cfe1ec73e97e692303310fb (2 x RaccoonStealer, 1 x CryptBot)
ssdeep 12288:yTRtXJdFFzJpT4Ky3MRdvoGwzDSJo8UyE4878s60QttVvZ:cjFFVp7S2toGKDbzyE487T60MVv
Threatray 122 similar samples on MalwareBazaar
TLSH 24D4122134E1E637E0D254714D38A2E2926AF9B3971054C3B7883BAE6B317E0AF35757
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
64ebbca7f69233721df621f56d169ed2.exe
Verdict:
Malicious activity
Analysis date:
2021-04-08 16:06:27 UTC
Tags:
stealer trojan loader
Link:
https://app.any.run/tasks/8915a518-1c06-4d17-bd41-63d6e931dea2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133244/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.64386.412.24926.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %temp% directory
Deleting a recently created file
Creating a file
Delayed reading of the file
Reading critical registry keys
Creating a window
DNS request
Connection attempt
Sending an HTTP POST request
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/670444
Signature
Antivirus detection for URL or domain
Contains functionality to register a low level keyboard hook
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 384164 Sample: XN123gfQJQ.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 91 Malicious sample detected (through community Yara rule) 2->91 93 Antivirus detection for URL or domain 2->93 95 Multi AV Scanner detection for dropped file 2->95 97 9 other signatures 2->97 12 XN123gfQJQ.exe 50 2->12         started        17 SmartClock.exe 2->17         started        19 SmartClock.exe 2->19         started        process3 dnsIp4 85 dyqtl42.top 34.118.72.185, 49765, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 12->85 87 estjh05.top 34.65.214.4, 49767, 49768, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 12->87 89 2 other IPs or domains 12->89 71 C:\Users\user\AppData\Local\...\Ikrapsor.exe, PE32 12->71 dropped 73 C:\Users\user\AppData\Local\...\lv[1].exe, PE32 12->73 dropped 119 Detected unpacking (changes PE section rights) 12->119 121 Detected unpacking (overwrites its own PE header) 12->121 123 Tries to harvest and steal browser information (history, passwords, etc) 12->123 21 Ikrapsor.exe 19 12->21         started        25 cmd.exe 1 12->25         started        file5 signatures6 process7 file8 63 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 21->63 dropped 65 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 21->65 dropped 67 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 21->67 dropped 99 Multi AV Scanner detection for dropped file 21->99 101 Machine Learning detection for dropped file 21->101 27 vpn.exe 7 21->27         started        29 4.exe 4 21->29         started        103 Submitted sample is a known malware sample 25->103 105 Obfuscated command line found 25->105 107 Uses ping.exe to sleep 25->107 109 Uses ping.exe to check the status of other devices and networks 25->109 32 conhost.exe 25->32         started        34 timeout.exe 1 25->34         started        signatures9 process10 file11 36 cmd.exe 1 27->36         started        38 dllhost.exe 27->38         started        75 C:\Users\user\AppData\...\SmartClock.exe, PE32 29->75 dropped 40 SmartClock.exe 29->40         started        process12 process13 42 cmd.exe 3 36->42         started        45 conhost.exe 36->45         started        signatures14 111 Obfuscated command line found 42->111 113 Uses ping.exe to sleep 42->113 47 Osato.exe.com 42->47         started        50 PING.EXE 42->50         started        53 findstr.exe 1 42->53         started        process15 dnsIp16 125 May check the online IP address of the machine 47->125 56 Osato.exe.com 47->56         started        77 127.0.0.1 unknown unknown 50->77 69 C:\Users\user\AppData\...\Osato.exe.com, Targa 53->69 dropped file17 signatures18 process19 dnsIp20 79 ip-api.com 208.95.112.1, 49774, 80 TUT-ASUS United States 56->79 81 ntEcUNaDbasrbEJM.ntEcUNaDbasrbEJM 56->81 59 wscript.exe 56->59         started        process21 dnsIp22 83 iplogger.org 88.99.66.31, 443, 49775 HETZNER-ASDE Germany 59->83 115 System process connects to network (likely due to code injection or exploit) 59->115 117 May check the online IP address of the machine 59->117 signatures23
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26e294b557033c04b7a9039b6e2ef1ec35f8c3ec1a06be3d7b73ddd3ff10395c/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-04-08 11:49:52 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
10c0f1080840ab3cf7fd69f80a6b821a6f95cb7b57a7e43dfb757e9df598c18a
CryptBot
135df51a2c255ab6c3614bc8ed4a32fdffbdf149e1f290bd845f08d8b77ec39a
CryptBot
39a27d15f3d6175331a974825a440d7475187bae0c133a48a1a5155b49a82537
CryptBot
76386b4c6c46b36b26d9ce00df7982d461bcd1a7586dde62cd831349d0aa3a4b
CryptBot
7bc379fd5f28ca0016ae282820d517d7719cad2742a22968cc3c9d3434ff469d
CryptBot
7c902b5da243bec90b83e4d68e4e8c097d1e36e9d9508c5095023f801440d977
CryptBot
80d4bc601ab1473cb21fc90f190ef7c00ffaa44705c170e6b01bac62eb7c7fd3
CryptBot
941d3312f126a5104966af87ce58d9be63bbaf63216723508d9dd2d2f241fea7
CryptBot
95989d92a6f3b866338f30ad894fcd576761d869e2c01e80f903e498e820f130
CryptBot
e784ba83c1139d2d9880a2cd5546d1d7716694452ea84367fa9c238f97d5e5ad
CryptBot
+ 112 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/210408-tnhlz6c37j/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies registry class
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
072189f03517f5036c0b3f26da3afe47eea2aca90ee592d4321bc16dcb3d8de2
MD5 hash:
890e9dffaeba2c68be3fbad0bd4b8c01
SHA1 hash:
f2030433a83d87dba5f21fd5066570bb2a1b50f2
Link:
https://www.unpac.me/results/71bd3d79-7a0d-4c04-8094-86c52bdadec7/
SH256 hash:
26e294b557033c04b7a9039b6e2ef1ec35f8c3ec1a06be3d7b73ddd3ff10395c
MD5 hash:
64ebbca7f69233721df621f56d169ed2
SHA1 hash:
1bcdda09f5478cee4aeb66cdd9a33fcb569ee9d0
Link:
https://www.unpac.me/results/71bd3d79-7a0d-4c04-8094-86c52bdadec7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/26e294b557033c04b7a9039b6e2ef1ec35f8c3ec1a06be3d7b73ddd3ff10395c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe 26e294b557033c04b7a9039b6e2ef1ec35f8c3ec1a06be3d7b73ddd3ff10395c

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/133244/
  
URLhaus
https://urlhaus.abuse.ch/url/1104406/
  
Delivery method
Distributed via web download

Comments