MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d090e48369efcdbebf9df5aed96857cd442509bb5f59e171f2b1b3cf1a56361. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d090e48369efcdbebf9df5aed96857cd442509bb5f59e171f2b1b3cf1a56361
SHA3-384 hash: b392ffa7571255f5050026f125b5a381f472bd0c2be952c60b9d359700724bd92e7a92cf04d5fecca306b9a3008b5779
SHA1 hash: 33509a78863b9bd7385054aa5bc92b8ce4f1ab5f
MD5 hash: 5a0ea4aab5f283b5c7d234322e04c6ce
humanhash: victor-beryllium-mountain-finch
File name:5a0ea4aab5f283b5c7d234322e04c6ce.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:351'232 bytes
First seen:2021-10-03 07:36:11 UTC
Last seen:2021-10-03 08:48:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0af56bf70c7b81394871a4713f3cc30b (3 x RaccoonStealer, 1 x CoinMiner, 1 x CryptBot)
ssdeep 6144:TQovZhTYZt0q9g4vYGDIIMJPdvQIZselS5OH8D7d0qthV07:ThxhYZt00gB6Ir1dImDS5T7d3zV0
Threatray 207 similar samples on MalwareBazaar
TLSH T1EB74BF20B7E0C030F4B756F589B99379AA297EB1A73441CFA3D02AEA56746D4DC30787
File icon (PE):PE icon
dhash icon 48e8e8e8aa62a499 (1 x CryptBot, 1 x RaccoonStealer)
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5a0ea4aab5f283b5c7d234322e04c6ce.exe
Verdict:
Malicious activity
Analysis date:
2021-10-03 08:01:50 UTC
Tags:
stealer trojan loader
Link:
https://app.any.run/tasks/108dac40-d33f-4d5c-bf92-bc387a400be4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/194316/
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.15707.31437.11397.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/615c2ec0b95458900cdc6394/reports/25d16d51-61ea-46cc-806f-af0249d09ea5/overview
Malware family:
CryptBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3a2f028d-fade-4a27-b8b2-932479e9390e
Result
Threat name:
Cryptbot Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/863371
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Cryptbot
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d090e48369efcdbebf9df5aed96857cd442509bb5f59e171f2b1b3cf1a56361/
Threat name:
Win32.Trojan.GenSteal
Create hunting rule
Status:
Malicious
First seen:
2021-10-02 18:19:08 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fueq4sbwt36nx27z35no3fufptkeeue3wx2z4fy7fmntz4nfmnqq._file
Verdict:
malicious
Similar samples:
0091825486c2d7cfdee49e98c6795be8d32a7f50a68e0d33542b1f047fb7ed7a
CryptBot
15ad913c094cd58fffa2067d86b75cf08fbcac95c16c2d68bab5b3498f059e31
CryptBot
20c3236616a266a4175355373d2d89742f9a4eae73f2c44b1a8e83a215fde9f1
CryptBot
30d8d3ac05ada80391a75a5f15b3d2a265bb06bc0e1dd48ef46f6d7c9099fc42
CryptBot
337b9f5f13ee874ebe70fd5468725b638eb7b62c4f8c91a6e2a7deab8f5edbb6
CryptBot
6563baa395257badd656572083aa05dc277e6516f079da5c0eddf0b6bbee4ffc
CryptBot
70d01c6918c07b4cd0daa9b2c688fbd7e0e2e6f77831c9bd351be29a7991e1d3
CryptBot
78145a56e10e0abe67f8eeff213dd874bba2824976ffda7fdd6818388c8951ed
CryptBot
a60659139ff3a9e6a4a482e060e301c83a25a02227308f6f572d79cc95c63dce
CryptBot
fce80390d1bfb9b5f02087bf0444534b885556180ca8b054d8ca9a6fab2e13c7
CryptBot
+ 197 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/211003-jft2bafba2/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
fb68d93118bf52c1a4c3378c810c2d8e3821ed9ad1d6173654a691941340d878
MD5 hash:
5a3f1df984684a9819a9d1a3ff194a69
SHA1 hash:
2dd6e26eb9ad7c67e0ab56a8f8a09f1791d2c197
Link:
https://www.unpac.me/results/c26c8de1-a1d6-4433-a028-4b8d2f9b1984/
SH256 hash:
2d090e48369efcdbebf9df5aed96857cd442509bb5f59e171f2b1b3cf1a56361
MD5 hash:
5a0ea4aab5f283b5c7d234322e04c6ce
SHA1 hash:
33509a78863b9bd7385054aa5bc92b8ce4f1ab5f
Link:
https://www.unpac.me/results/c26c8de1-a1d6-4433-a028-4b8d2f9b1984/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2d090e48369efcdbebf9df5aed96857cd442509bb5f59e171f2b1b3cf1a56361

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe 2d090e48369efcdbebf9df5aed96857cd442509bb5f59e171f2b1b3cf1a56361

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1650387/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/194316/

Comments