MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 542f9197e3f7417eefc772580a332009a9e73a63fd7cdf1078db5a34af8db0a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptOne


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 542f9197e3f7417eefc772580a332009a9e73a63fd7cdf1078db5a34af8db0a9
SHA3-384 hash: f41a0c61ab9929dc48405def09e197f3884fa7c83c162a3e5c6b873d5432763a1ff3d66f405588dc81f9173f3206b99f
SHA1 hash: 4b49d898fff5ee6d60803c8197c089d00bd77688
MD5 hash: 5eb35f7efb394be2ab907a759047c3ce
humanhash: green-batman-happy-winner
File name:file
Download: download sample
Signature CryptOne
Create hunting rule
File size:1'675'137 bytes
First seen:2022-10-03 19:55:26 UTC
Last seen:2022-10-03 20:03:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ab9ff6e4872ea2766a5f5c6af5649e9d (20 x CryptOne, 13 x RedLineStealer, 6 x RecordBreaker)
ssdeep 24576:VJr8tEZgHqd8tlJFcqflrJu9bGKMhq7AJeZwEPhQNgskIOZrxov7g8AXE6d+oJtL:VJ4ogp7Pu999wehfY0oMaU3uo
Threatray 286 similar samples on MalwareBazaar
TLSH T1F2752311B9C18871D27229351AF7DA316A3D7C322B759EDF43386B0E5E705C0973ABA2
TrID 91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
1.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter andretavare5
Tags:CryptOne exe


Avatar
andretavare5
Sample downloaded from https://asassasss.autos/331_331/setup331.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
312
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/316233/
Detection(s):
SecuriteInfo.com.Variant.Fugrafa.249470.10364.14457.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Creating a file in the system32 subdirectories
Creating a file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/40924/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
greyware overlay packed packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/633b3e54d089a0c15dd4d8bd/reports/994e34a4-902c-403d-b292-1de95f736cd0/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/712556c1-9779-4d35-85fd-6902baeb4e19
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1082794
Signature
Machine Learning detection for sample
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 715350 Sample: file.exe Startdate: 03/10/2022 Architecture: WINDOWS Score: 52 22 Yara detected CryptOne packer 2->22 24 Machine Learning detection for sample 2->24 9 file.exe 8 2->9         started        process3 file4 20 C:\Users\user\AppData\Local\Temp\59HF8g.gk, PE32 9->20 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        process7 16 rundll32.exe 14->16         started        process8 18 rundll32.exe 16->18         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/542f9197e3f7417eefc772580a332009a9e73a63fd7cdf1078db5a34af8db0a9/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-10-03 19:56:14 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kqxzdf7d65ax536hojmaumzabgu6ootd7v6n6edy3nndjl4nwcuq._file
Verdict:
malicious
Similar samples:
0411663612d47e64b4ae08bd9c989141d00118fc327a1162eee523fb55df2520
CryptOne
0f6ba193731637582c0978e84b61eec89c74fed19dda92d0a72614f9b7f88169
CryptOne
4530cf8ecd84e61bba079e29913f992046e314b1481b1d94afaa789908c26f59
CryptOne
868bb2b1387c06898cc942fc7a2858a19c907622379e9705eeed3591c488cdb9
CryptOne
9dfc2b987cfac7d4b2dc842bef5d9680724a0d8a65bef2ef175ad2e5672e429b
CryptOne
b160d96699180b3b72a5547b36f2fa70bd584c449d0ba82953ee00692dfa6aa5
CryptOne
e8e3cddcc753e66757c3d6a47b63117f718103f03a039b40a4553849e04b8aec
CryptOne
f54a8831bb18bebc4d0da8f21487b8dcefafa30e327cf531e6f534d44cea3e6c
CryptOne
+ 276 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221003-ynnxladda4/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Gathering data
Unpacked files
SH256 hash:
8a92a8849c6e960725dfeca1a440e6b8a0e43e4a0764f18976908cb5482b0460
MD5 hash:
149ba1171fc564dec5c2cea1146e1185
SHA1 hash:
8d4913e0f1454d4d58020056fd0c9a623165e42b
Link:
https://www.unpac.me/results/f0015652-3519-4508-acd5-210be36f8a56/
SH256 hash:
cf9fbf00e6780535829523b5bef9fd14551074e24b55b071902599a3dfd09ebf
MD5 hash:
d3744db87ca08855eb0d85f67333ea03
SHA1 hash:
565aebf76c766d7af880dc302eb8d821b0c9dec3
Link:
https://www.unpac.me/results/f0015652-3519-4508-acd5-210be36f8a56/
SH256 hash:
542f9197e3f7417eefc772580a332009a9e73a63fd7cdf1078db5a34af8db0a9
MD5 hash:
5eb35f7efb394be2ab907a759047c3ce
SHA1 hash:
4b49d898fff5ee6d60803c8197c089d00bd77688
Link:
https://www.unpac.me/results/f0015652-3519-4508-acd5-210be36f8a56/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/542f9197e3f7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/542f9197e3f7417eefc772580a332009a9e73a63fd7cdf1078db5a34af8db0a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:RansomwareTest8
Create hunting rule
Author:Daoyuan Wu
Description:Test Ransomware YARA rules

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2306570/
Cape
Cape
https://www.capesandbox.com/analysis/316233/

Comments