MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bddc130613ede4832dd4251843b168282b71c4eedfdb1772fd83bf08979ed32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 11


Intelligence 11 IOCs 2 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5bddc130613ede4832dd4251843b168282b71c4eedfdb1772fd83bf08979ed32
SHA3-384 hash: c3039b6583e1af6074850a2d62cabb8a69471d031bf18606dde491817b379246d634b7d7d17c4a27bc5b234308e8ff05
SHA1 hash: 411cbfe2ce9d7c680ab21abfd84a8ae85659a33e
MD5 hash: eef9be1c376b2031d057ab3f50ef9fe4
humanhash: sad-sweet-pluto-beer
File name:EEF9BE1C376B2031D057AB3F50EF9FE4.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:375'296 bytes
First seen:2021-07-17 17:40:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fe900e822e1a14acc67063f6a133bd2f (1 x CryptBot)
ssdeep 6144:RHaCyWp1qVtHBdnYPzEDNEKSCJFMcaEMaC2zwPmmy:tJdp1qVlXYL02rCJiEFxc+
Threatray 2'034 similar samples on MalwareBazaar
TLSH T1F984AE20AAA0C235F1B326B4897993A89929BDB15F2450CBF2C57BDF26353D49CF0753
Reporter abuse_ch
Tags:CryptBot exe


Avatar
abuse_ch
CryptBot C2:
http://morxek06.top/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://morxek06.top/index.php https://threatfox.abuse.ch/ioc/160880/
http://wymidc62.top/index.php https://threatfox.abuse.ch/ioc/160881/

Intelligence

File Origin
# of uploads :
1
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
EEF9BE1C376B2031D057AB3F50EF9FE4.exe
Verdict:
Malicious activity
Analysis date:
2021-07-17 17:43:39 UTC
Tags:
trojan evasion loader stealer raccoon rat redline
Link:
https://app.any.run/tasks/91426264-229c-4091-9885-77718a4f1e87

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Gcleaner
Create hunting rule
Link:
https://www.capesandbox.com/analysis/172356/
Detection(s):
Win.Malware.Filerepmalware-9877678-0
Create hunting rule

Win.Packed.Filerepmalware-9877957-0
Create hunting rule

Win.Malware.Pwsx-9877959-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5de7e678-0db1-4b85-bf18-a1e6e389d6a8
Result
Threat name:
Raccoon RedLine
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817850
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Sigma detected: Regsvr32 Anomaly
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 450261 Sample: E2QIvDXi7H.exe Startdate: 17/07/2021 Architecture: WINDOWS Score: 100 67 closestep.top 2->67 69 api.ip.sb 2->69 71 iplogger.org 2->71 83 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->83 85 Multi AV Scanner detection for domain / URL 2->85 87 Found malware configuration 2->87 89 8 other signatures 2->89 10 E2QIvDXi7H.exe 29 2->10         started        signatures3 process4 dnsIp5 77 gcl-partners.in 91.241.19.12, 49731, 49732, 49733 REDBYTES-ASRU Russian Federation 10->77 79 hofria09.top 47.243.129.23, 49749, 49750, 49753 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC United States 10->79 81 4 other IPs or domains 10->81 59 C:\Users\user\AppData\...\35912811222.exe, PE32 10->59 dropped 61 C:\Users\user\AppData\...\99815011201.exe, PE32 10->61 dropped 63 C:\Users\user\AppData\...\73147417915.exe, PE32 10->63 dropped 65 6 other files (none is malicious) 10->65 dropped 99 May check the online IP address of the machine 10->99 15 cmd.exe 10->15         started        17 WerFault.exe 9 10->17         started        20 WerFault.exe 9 10->20         started        22 7 other processes 10->22 file6 signatures7 process8 file9 24 35912811222.exe 15->24         started        29 conhost.exe 15->29         started        39 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 17->39 dropped 41 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 20->41 dropped 43 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 22->43 dropped 45 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 22->45 dropped 47 C:\ProgramData\Microsoft\...\Report.wer, Little-endian 22->47 dropped 49 3 other malicious files 22->49 dropped 31 conhost.exe 22->31         started        process10 dnsIp11 73 telete.in 195.201.225.248, 443, 49751 HETZNER-ASDE Germany 24->73 75 34.89.184.90, 49752, 80 GOOGLEUS United States 24->75 51 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 24->51 dropped 53 C:\Users\user\AppData\...\vcruntime140.dll, PE32 24->53 dropped 55 C:\Users\user\AppData\...\ucrtbase.dll, PE32 24->55 dropped 57 56 other files (none is malicious) 24->57 dropped 91 Detected unpacking (changes PE section rights) 24->91 93 Detected unpacking (overwrites its own PE header) 24->93 95 Tries to steal Mail credentials (via file access) 24->95 97 2 other signatures 24->97 33 cmd.exe 24->33         started        file12 signatures13 process14 process15 35 conhost.exe 33->35         started        37 timeout.exe 33->37         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5bddc130613ede4832dd4251843b168282b71c4eedfdb1772fd83bf08979ed32/
Threat name:
Win32.Ransomware.Stop
Create hunting rule
Status:
Malicious
First seen:
2021-07-15 21:20:44 UTC
AV detection:
23 of 28 (82.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lpo4cmdbh3peqmw5ijiyioywqkblohco5x63c5zp3a57bclz5uza._file
Verdict:
malicious
Similar samples:
12f0a80b6374b38a3997a7ef4528f26ccbca664b26e48533e7d1f36c78da76f4
CryptBot
17a54b98e0fa1559a540e2ec3c30f0c23d8a8cbe7b18c8fe1f4241945f314e5e
CryptBot
255a309aa4ac9d53e3de0f3247b3388d6376af9efb19f8256fd8d1db5bfb2448
CryptBot
377030b4311c86adfdbab3a625400cfeae0288f71bb6a3530ed022a9ff87b04e
CryptBot
463a368c85c49254ec2a84f7a042c3ec68353b7e0280ba464701ca13a7391c5b
CryptBot
571b3f0b4685473b424f7fb3b67344cd1441930fa7f966e3a4cd41875fde8de3
CryptBot
62d42586d48418b0fee5bd7705bb05eb6a2db50327e7b69f2a3f35eb57e80c1b
CryptBot
7525f2c1ccec025adb8f773ab10ecd9cee7bacec9949a7415ad239cec969bfb8
CryptBot
b2ee06af075bcc9cb66e685417684c91df5cea6679a8ccf6608857dab0a46b50
CryptBot
fb5d2b6d9ec1b9c07e64f6b9eb148099f0b43d58dc867102c02b16a9a9152022
CryptBot
+ 2'024 additional samples on MalwareBazaar
Result
Malware family:
redline
Create hunting rule
Score:
  10/10
Tags:
family:cryptbot family:raccoon family:redline botnet:mix 18.07 discovery infostealer spyware stealer
Link:
https://tria.ge/reports/210717-zyaejqgpxx/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Deletes itself
Drops startup file
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
CryptBot
CryptBot Payload
Raccoon
RedLine
RedLine Payload
Malware Config
C2 Extraction:
wymidc62.top
morxek06.top
185.215.113.17:18597
Unpacked files
SH256 hash:
9993f1bfd17a2619ab047795a2130906e5e0a060835fe5ce43d20e04e3aa742b
MD5 hash:
9a83572c76219b87009a66fcb40112cd
SHA1 hash:
ef4974c09784d9cd08476ecea0c9f5190681ba9a
Link:
https://www.unpac.me/results/80cddd40-b0de-4e0e-b963-3167fd017f70/
SH256 hash:
5bddc130613ede4832dd4251843b168282b71c4eedfdb1772fd83bf08979ed32
MD5 hash:
eef9be1c376b2031d057ab3f50ef9fe4
SHA1 hash:
411cbfe2ce9d7c680ab21abfd84a8ae85659a33e
Link:
https://www.unpac.me/results/80cddd40-b0de-4e0e-b963-3167fd017f70/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5bddc130613ede4832dd4251843b168282b71c4eedfdb1772fd83bf08979ed32

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_XORed_Mozilla
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed keyword - Mozilla/5.0
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/172356/

Comments