MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b6f69b3ade95902351f28e2862234569b3ddd1166b1e936441b530524a32c33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b6f69b3ade95902351f28e2862234569b3ddd1166b1e936441b530524a32c33
SHA3-384 hash: 22ca166a80561cb3ab0f53524721417045376e761edf12b695c88283e73ef54235302adb05a60369be425e78c91fa91a
SHA1 hash: 15a17bf9120c528cfd30ec4c1f8476e6f5101a53
MD5 hash: 9de6a31aa1eb76e7132658397d08f5a2
humanhash: triple-chicken-illinois-monkey
File name:file.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:748'544 bytes
First seen:2021-04-12 06:35:51 UTC
Last seen:2021-04-12 09:55:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1c198acdc88e6433341d82c12cfad0a9 (2 x Formbook, 1 x CryptBot)
ssdeep 12288:Kqe6gWLfgvXm+9sScMsOZGbL6i8aH7x49nVZvYZjkfKKNGOZ/eYdFlmxcLHo2I:KnWUvX412ulH7x4/ZMQyKQSeYHlmxm/I
Threatray 132 similar samples on MalwareBazaar
TLSH 89F4010173D5C072D05325B64419C7B15EBE78324A7AE98BBBD90BFC9F2A6D0671A30B
Reporter JAMESWT_WT
Tags:CryptBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file.exe
Verdict:
Malicious activity
Analysis date:
2021-04-12 06:43:51 UTC
Tags:
stealer trojan
Link:
https://app.any.run/tasks/8d083a1b-a295-49d0-86eb-df764258eb72

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133659/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.21063.24964.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Changing a file
Creating a file in the %temp% directory
Deleting a recently created file
Creating a file
Delayed reading of the file
Reading critical registry keys
Creating a window
Sending a UDP request
DNS request
Connection attempt
Sending an HTTP POST request
Creating a file in the Windows subdirectories
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/672614
Signature
Contains functionality to register a low level keyboard hook
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 385256 Sample: file.exe Startdate: 12/04/2021 Architecture: WINDOWS Score: 100 64 EiodCJGkPupHarewIHgoYXhjJQvRZ.EiodCJGkPupHarewIHgoYXhjJQvRZ 2->64 76 Malicious sample detected (through community Yara rule) 2->76 78 Multi AV Scanner detection for dropped file 2->78 80 Multi AV Scanner detection for submitted file 2->80 82 8 other signatures 2->82 10 file.exe 50 2->10         started        15 SmartClock.exe 2->15         started        signatures3 process4 dnsIp5 66 awumad01.top 35.228.166.216, 49732, 49733, 80 GOOGLEUS United States 10->66 68 mardeq01.top 34.116.248.73, 49726, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 10->68 70 aufsvg12.top 34.118.72.185, 49725, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 10->70 60 C:\Users\user\AppData\Local\Temp\Murano.exe, PE32 10->60 dropped 62 C:\Users\user\AppData\Local\...\lv[1].exe, PE32 10->62 dropped 84 Detected unpacking (changes PE section rights) 10->84 86 Detected unpacking (overwrites its own PE header) 10->86 88 Tries to harvest and steal browser information (history, passwords, etc) 10->88 17 Murano.exe 19 10->17         started        21 cmd.exe 1 10->21         started        file6 signatures7 process8 file9 52 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 17->52 dropped 54 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 17->54 dropped 56 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 17->56 dropped 72 Multi AV Scanner detection for dropped file 17->72 74 Machine Learning detection for dropped file 17->74 23 4.exe 4 17->23         started        26 vpn.exe 7 17->26         started        28 conhost.exe 21->28         started        30 timeout.exe 1 21->30         started        signatures10 process11 file12 58 C:\Users\user\AppData\...\SmartClock.exe, PE32 23->58 dropped 32 SmartClock.exe 23->32         started        34 makecab.exe 1 26->34         started        36 makecab.exe 1 26->36         started        38 makecab.exe 1 26->38         started        40 3 other processes 26->40 process13 process14 42 conhost.exe 34->42         started        44 conhost.exe 36->44         started        46 conhost.exe 38->46         started        48 conhost.exe 40->48         started        50 conhost.exe 40->50         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b6f69b3ade95902351f28e2862234569b3ddd1166b1e936441b530524a32c33/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-04-12 06:36:11 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jnxwtm5n5fmqeni7fdrimiruk2nt3xirm2y6snsednjqkjfdfqzq._file
Verdict:
suspicious
Similar samples:
0bdb7a98c650426ff70b666a8a1f28b421a6135e729a70baf87a5c126fbd788a
CryptBot
135df51a2c255ab6c3614bc8ed4a32fdffbdf149e1f290bd845f08d8b77ec39a
CryptBot
26e294b557033c04b7a9039b6e2ef1ec35f8c3ec1a06be3d7b73ddd3ff10395c
CryptBot
7bc379fd5f28ca0016ae282820d517d7719cad2742a22968cc3c9d3434ff469d
CryptBot
97d497e3e5e60db871dfde169070847b7067fcd409f9dbed19584c3b64ac9ac9
CryptBot
ac2c2e2b67deca31d1f61ff956ef8b676fa733da9c682f26fbda28b46c6e6f63
CryptBot
c3fd41da298b657f36085d828012a94c9979400b753c028eb26d0a6fb50b05bb
CryptBot
c8a30abef2939b6c3b6193feffbaf8ba4a87c79fc32e71b10b94bbdb8e1e238f
CryptBot
e784ba83c1139d2d9880a2cd5546d1d7716694452ea84367fa9c238f97d5e5ad
CryptBot
ec7db23abe0578993c032c1c962db58d72bc1cdcb8401d33e60e92f784defb75
CryptBot
+ 122 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/210412-jpm5v9fhw6/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
1c8aa27840154334812a12770ebd9c692902452dfc1ea10b6a0c3c3b32c9162a
MD5 hash:
df0d4b65092faac79e245e61a37fdf2b
SHA1 hash:
a0f2b45b28780654f4c71c189de8297a87abf26d
Link:
https://www.unpac.me/results/9a99383d-0a46-407d-a4fb-f77b711d0ef1/
SH256 hash:
4b6f69b3ade95902351f28e2862234569b3ddd1166b1e936441b530524a32c33
MD5 hash:
9de6a31aa1eb76e7132658397d08f5a2
SHA1 hash:
15a17bf9120c528cfd30ec4c1f8476e6f5101a53
Link:
https://www.unpac.me/results/9a99383d-0a46-407d-a4fb-f77b711d0ef1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4b6f69b3ade95902351f28e2862234569b3ddd1166b1e936441b530524a32c33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe 4b6f69b3ade95902351f28e2862234569b3ddd1166b1e936441b530524a32c33

(this sample)

  
X
https://twitter.com/jstrosch/status/1381402587119845382?s=20
Cape
Cape
https://www.capesandbox.com/analysis/133659/
  
URLhaus
https://urlhaus.abuse.ch/url/1107074/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1107223/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-14 14:17:21 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0012.001] Anti-Static Analysis::Argument Obfuscation
1) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
2) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
3) [C0049] File System Micro-objective::Get File Attributes
4) [C0051] File System Micro-objective::Read File
5) [C0050] File System Micro-objective::Set File Attributes
6) [C0052] File System Micro-objective::Writes File
7) [C0033] Operating System Micro-objective::Console
8) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
9) [C0040] Process Micro-objective::Allocate Thread Local Storage
10) [C0041] Process Micro-objective::Set Thread Local Storage Value
11) [C0018] Process Micro-objective::Terminate Process