MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57ad94e4e277cbfcdf8b7a5a1f426101e07d913741cdb2307016a84e77b0a95f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptOne


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 57ad94e4e277cbfcdf8b7a5a1f426101e07d913741cdb2307016a84e77b0a95f
SHA3-384 hash: fa1ba8de113676080f1ecf7e90e2247101fb377d761495a85ab698b5644b27d1325c1692be780615e4c51fe9f5b00ab9
SHA1 hash: 188d51bf71c161caea0b77f1b64d205514539ce7
MD5 hash: b8df4f501adfc1e0b5d108f123a79483
humanhash: cola-floor-double-pluto
File name:b8df4f501adfc1e0b5d108f123a79483.exe
Download: download sample
Signature CryptOne
Create hunting rule
File size:1'660'684 bytes
First seen:2022-12-18 07:48:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (864 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 24576:jFL23n5BfJXAENzLGXn8QMIFw2HQEUk5XjDPTKUYEm+ZmK7LMyLAExJj:F0BfJXAEhG38QM+7QEFTrvY6ZC4AEv
Threatray 2'748 similar samples on MalwareBazaar
TLSH T102752303BF918871C5B31E319939AF51A4BD3C201E24E64FE7E40D69AF752826529FB3
TrID 88.3% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
4.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.0% (.EXE) Win32 Executable (generic) (4505/5/1)
0.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon b3b3b371716b93b3 (25 x CryptOne, 12 x RemcosRAT, 6 x RedLineStealer)
Reporter abuse_ch
Tags:CryptOne exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b8df4f501adfc1e0b5d108f123a79483.exe
Verdict:
Malicious activity
Analysis date:
2022-12-18 07:51:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4f100763-3758-464a-89db-1c946477bbff

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/347528/
Detection(s):
SecuriteInfo.com.Trojan.Uztuby.4.29290.7140.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Gathering data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2b4a7f20-7542-49cc-8251-ff2c404001f3
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1136270
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 768998 Sample: f1G4KT717d.exe Startdate: 18/12/2022 Architecture: WINDOWS Score: 88 22 Antivirus detection for dropped file 2->22 24 Antivirus / Scanner detection for submitted sample 2->24 26 Multi AV Scanner detection for dropped file 2->26 28 4 other signatures 2->28 9 f1G4KT717d.exe 8 2->9         started        process3 file4 20 C:\Users\user\AppData\Local\Temp\nWWEm00Q.8, PE32 9->20 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        process7 16 rundll32.exe 14->16         started        process8 18 rundll32.exe 16->18         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/57ad94e4e277cbfcdf8b7a5a1f426101e07d913741cdb2307016a84e77b0a95f/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-12-17 21:52:01 UTC
File Type:
PE (Exe)
Extracted files:
21
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k6wzjzhco7f7zx4lpjnb6qtbahqh3ejxihg3emdqc2ue455qvfpq._file
Verdict:
malicious
Similar samples:
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
CryptOne
4618fb57958c19496e668916d769cb40e6bb0a0af0fbb1ff73ee89e701f3fe9b
CryptOne
7a6c916427ad4b4693f276085914313efc50a9b2716428bb644a35df82461126
CryptOne
b1f692dd52aae8317db7cfd262a4bcc053cf721fc7a00bf66f4acc7cb5cc6cbc
CryptOne
b2a324897aebabb250e405cf19388be6979b40615b16b7b7d816c44ca90ec3fe
CryptOne
b3a3645cf2d804bebd0d8049b70c95ae545ff06ca2acc9f85721a1d1f3c9b5b8
CryptOne
bea445cd71f0615353625114161291b7b9cab80829b3670951252053c72e68d4
CryptOne
d15e506977055556f490656e5abddb4c774ed22f58d7fa6ec6523e0148911408
CryptOne
df59ccb9d70f7f61dc2c65faa61446278fb402b64401f2f3cfe8bbad72f70610
CryptOne
f5b89abfe105466c052dc8458a33028fb0304b6a55fb4ceaa332dbbe4add925f
CryptOne
+ 2'738 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221218-jnpfssba48/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/827c7fc1-dfc3-4b6c-ae1a-8e274074425a
Unpacked files
SH256 hash:
5ac36287b73693a07614e335e53af5542ae0d73ecdadb2e80f4074c6e5779817
MD5 hash:
7ec18520fe2d0527e22ed7dc38e4e4ab
SHA1 hash:
352a047f6630fdd27787338160d471a88bf978f7
Link:
https://www.unpac.me/results/10856f39-335b-4fac-892d-56d463306186/
SH256 hash:
cf254ef3a3b5cc41ca8c7029e5de33c4c6bbf1e7079a499ceb98f63ed8e0d3fe
MD5 hash:
819ac70eeb5609e5b41aea1070daeac8
SHA1 hash:
47b5c34a921768eefcf09cfda63162f0e95b7ccd
Link:
https://www.unpac.me/results/10856f39-335b-4fac-892d-56d463306186/
SH256 hash:
57ad94e4e277cbfcdf8b7a5a1f426101e07d913741cdb2307016a84e77b0a95f
MD5 hash:
b8df4f501adfc1e0b5d108f123a79483
SHA1 hash:
188d51bf71c161caea0b77f1b64d205514539ce7
Link:
https://www.unpac.me/results/10856f39-335b-4fac-892d-56d463306186/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/57ad94e4e277/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/57ad94e4e277cbfcdf8b7a5a1f426101e07d913741cdb2307016a84e77b0a95f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptOne

Executable exe 57ad94e4e277cbfcdf8b7a5a1f426101e07d913741cdb2307016a84e77b0a95f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2468059/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/347528/

Comments