MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4036ab3fa5a19cdc1064ad55047dd766ea21cb1ffd4f1e4fa037eb29fa813fb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 11


Intelligence 11 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4036ab3fa5a19cdc1064ad55047dd766ea21cb1ffd4f1e4fa037eb29fa813fb2
SHA3-384 hash: 71cebbd0927d1bc04f717efe31335058494f0abb3adc7fa6e57d6883b527a29b2421d85dd55f33b5339ee4e1ad96f602
SHA1 hash: ebc13af0137dd53f8275ff41990ae86fc32a0b10
MD5 hash: 7599ea7a23c0b0d9ecb7c895e9f8cfdb
humanhash: oranges-fillet-yankee-oklahoma
File name:7599ea7a23c0b0d9ecb7c895e9f8cfdb.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:6'698'156 bytes
First seen:2024-12-24 07:33:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:pc2DokHnRSoWQr8KnAAwQ4yrc/PHanO2xMWgV5BPo42wOeJhmwsg3H:pcuEoWQHAnRyKP6O2xxe5W42wWMX
TLSH T1AD664B85EAEB91F5DA8315715016B73F6F71B6029A35CEF6CBC0CE34C562A116A0E32C
TrID 30.2% (.EXE) Win64 Executable (generic) (10522/11/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4504/4/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
408
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Stealer.41541.11479.19162.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
95.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=676a63fa75bf3268d2fe2ca7
Tags:
dropper virus smtp
Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/676a63f77bbc7aaa4c974222/reports/6d3720cc-af21-4583-badf-df67b3b9f408/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/4036ab3fa5a19cdc1064ad55047dd766ea21cb1ffd4f1e4fa037eb29fa813fb2
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e7cbb98e-eb2c-4bc2-bfa4-1a4682bf1289
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1580272
Signature
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
94%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/4036ab3fa5a19cdc1064ad55047dd766ea21cb1ffd4f1e4fa037eb29fa813fb2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4036ab3fa5a19cdc1064ad55047dd766ea21cb1ffd4f1e4fa037eb29fa813fb2/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ia3kwp5fugonyedevvkqi7oxm3vcdsy77vhr4t5ag7vst6ubh6za._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/241224-jd4sqssqbw/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/feecbb88-7269-45ee-b74f-9e833dadaa7c
Unpacked files
SH256 hash:
4036ab3fa5a19cdc1064ad55047dd766ea21cb1ffd4f1e4fa037eb29fa813fb2
MD5 hash:
7599ea7a23c0b0d9ecb7c895e9f8cfdb
SHA1 hash:
ebc13af0137dd53f8275ff41990ae86fc32a0b10
Detections:
CryptBot
Create hunting rule
Link:
https://www.unpac.me/results/458e0ea4-fd11-4287-8b50-c90b1f00a829/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4036ab3fa5a19cdc1064ad55047dd766ea21cb1ffd4f1e4fa037eb29fa813fb2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RansomPyShield_Antiransomware
Create hunting rule
Author:XiAnzheng
Description:Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe 4036ab3fa5a19cdc1064ad55047dd766ea21cb1ffd4f1e4fa037eb29fa813fb2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3299894/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments