MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2709f083327060b896501645e3263462cf0e329645e41f6d4556276904c51856. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptOne


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2709f083327060b896501645e3263462cf0e329645e41f6d4556276904c51856
SHA3-384 hash: 101b51bbf28bdec5f5a8ccf61a8245170e3735a25e6e9a455e502ed4a547c969356be804f4b093d033a4548eb65bae4b
SHA1 hash: 451f3abb1337686c210d047ca84f917b3e9b5490
MD5 hash: 7af373f612f06bcd4a66251c89b50a6b
humanhash: sink-apart-queen-spring
File name:2709f083327060b896501645e3263462cf0e329645e41f6d4556276904c51856
Download: download sample
Signature CryptOne
Create hunting rule
File size:2'149'502 bytes
First seen:2022-10-11 10:57:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (388 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 49152:IBJJJugQ/RwSVbVRLbOA2gPUhLMz4qSJV:yxu/wSFVRXYEU
Threatray 1'247 similar samples on MalwareBazaar
TLSH T1D6A523027AD5D9F2D41519331A24EE11663DBD206F398ECF73897A9DDA319C08B307A7
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter adrian__luca
Tags:CryptOne exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
233
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2709f083327060b896501645e3263462cf0e329645e41f6d4556276904c51856
Verdict:
Malicious activity
Analysis date:
2022-10-11 10:54:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5fba61d9-3606-4b06-bf52-7cf7097957d5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318913/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Sending a custom TCP request
DNS request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/42486/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm greyware overlay packed qbot setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/63454c3c5cada2cbc6eb8fdc/reports/db76e30a-e5a2-439c-9f84-ca8e1c3266bf/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d58ebf1e-7ad7-4872-aef9-2d614039d4b9
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1087908
Signature
Contains functionality to detect sleep reduction / modifications
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 720486 Sample: 9171sRrsO1.exe Startdate: 11/10/2022 Architecture: WINDOWS Score: 76 23 Multi AV Scanner detection for dropped file 2->23 25 Multi AV Scanner detection for submitted file 2->25 27 Yara detected CryptOne packer 2->27 29 2 other signatures 2->29 9 9171sRrsO1.exe 3 8 2->9         started        process3 file4 21 C:\Users\user\AppData\Local\Temp\ViNnwR.cpl, PE32 9->21 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        signatures7 31 Contains functionality to detect sleep reduction / modifications 14->31 17 rundll32.exe 14->17         started        process8 process9 19 rundll32.exe 17->19         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2709f083327060b896501645e3263462cf0e329645e41f6d4556276904c51856/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-10-01 04:51:00 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e4e7bazsobqlrfsqczc6gjrumlhq4muwixsb63kfkytwsbgfdbla._file
Verdict:
malicious
Similar samples:
10f1d986b6f2654efc7755aa433247b63228ce237a97f9eb29bfb74d0b602acd
CryptOne
301a3e665000c99ab655a74dbf9408de24875866528be4f6d28e83490c19305b
CryptOne
3a0597925d2b7686d2386591f60a7abe686c0e10e2e164405270cc0d83e4b128
CryptOne
4ca4415993e8bead0b3a27efb2f31a36e551a3f7d5bcb97d29e6700653198173
CryptOne
51986665322a79945ae565a363862e8007b3be459855f27c11c062da0eb59db8
CryptOne
7571b1e23ad03a0ce6c5a1dd2593eb01bb7ffcf42e192d4e0cfef32ce493609e
CryptOne
8f8cb5930100e80159502fd6d224909606f47ff17614f89b41b650afc3a91b6d
CryptOne
c787c9a5f407a656478efc835f1a0f8f738030bf26cedbd4748cb7b18ed2ea3e
CryptOne
e9f669028697238e2a9a181b9e409909695d03eccd09a35db30729fb51952527
CryptOne
+ 1'237 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221011-m2tt8abca2/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e721d837-3e8b-4d15-a890-1a4cce68b8a7
Unpacked files
SH256 hash:
49ca130cf38aedbd812945135f9530e8cd9da8578db41aaf8404390c320cb656
MD5 hash:
2119a85723b12b9fd5f2b0a02e61b7eb
SHA1 hash:
6937fe1e75170580be2a26e945bf3b37373cba6b
Link:
https://www.unpac.me/results/6f32a2d6-63ac-4ec8-aa3b-be8cece6d697/
SH256 hash:
d59b502d9e1359841adb3ff5c72e85b1d74c517940dab234787e21be9b43e356
MD5 hash:
c82c6f0d6f3bb35af517b3487fd9f9a0
SHA1 hash:
f6cea1257751d8353686f688ef831935494ea376
Link:
https://www.unpac.me/results/6f32a2d6-63ac-4ec8-aa3b-be8cece6d697/
SH256 hash:
2709f083327060b896501645e3263462cf0e329645e41f6d4556276904c51856
MD5 hash:
7af373f612f06bcd4a66251c89b50a6b
SHA1 hash:
451f3abb1337686c210d047ca84f917b3e9b5490
Link:
https://www.unpac.me/results/6f32a2d6-63ac-4ec8-aa3b-be8cece6d697/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2709f0833270/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2709f083327060b896501645e3263462cf0e329645e41f6d4556276904c51856

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/318913/

Comments