MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62ffc5fabaf9853f0b3821f6dffbb876c7d38f7f68d4b7d14b9fc4fc0fddc36d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptOne


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62ffc5fabaf9853f0b3821f6dffbb876c7d38f7f68d4b7d14b9fc4fc0fddc36d
SHA3-384 hash: 96ffc5dc3e48918b8fa236871908f5e5b080b36c9328692ed9da1c89c138a095bb8292398c5b5696c60e5700fbf2af04
SHA1 hash: f3e3e279bb6e1df1c8748ee4e6bc30b6256c7925
MD5 hash: b43daa9d1f879fc8ba3718dcfa063c19
humanhash: hawaii-autumn-emma-mockingbird
File name:b43daa9d1f879fc8ba3718dcfa063c19.exe
Download: download sample
Signature CryptOne
Create hunting rule
File size:1'734'051 bytes
First seen:2022-11-11 10:20:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (388 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 24576:2TbBv5rUyXVHm0syj9KswaylRsjlEFYZPrubuOv0AukftGp/yzReagdCjL/eKqD7:IBJGPypK51lWjlFPKc+Km3gwDqM1Zs19
Threatray 1'930 similar samples on MalwareBazaar
TLSH T1A48523117AD199B2D1232C325A65AB20297CFD301FA9CECF5394262EED325C2DB35762
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:CryptOne exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b43daa9d1f879fc8ba3718dcfa063c19.exe
Verdict:
Malicious activity
Analysis date:
2022-11-11 10:36:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/863f36e0-10d8-427e-a8ac-be8c31d95805

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/332416/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/51298/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/636e221637a53af3a7f560d5/reports/0780c616-eff1-46bb-900a-cec978fca516/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/41456970-a858-440d-9938-83c15cc25f4f
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1111178
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 743873 Sample: R3kpR5E056.exe Startdate: 11/11/2022 Architecture: WINDOWS Score: 72 22 Multi AV Scanner detection for dropped file 2->22 24 Multi AV Scanner detection for submitted file 2->24 26 Yara detected CryptOne packer 2->26 28 2 other signatures 2->28 9 R3kpR5E056.exe 3 8 2->9         started        process3 file4 20 C:\Users\user\AppData\Local\...\5kYYnRqi.cpl, PE32 9->20 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        process7 16 rundll32.exe 14->16         started        process8 18 rundll32.exe 16->18         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62ffc5fabaf9853f0b3821f6dffbb876c7d38f7f68d4b7d14b9fc4fc0fddc36d/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-11-11 08:16:48 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ml74l6v27gct6czyeh3n765yo3d5hd37ndklpuklt7cpyd65ynwq._file
Verdict:
malicious
Similar samples:
10f1d986b6f2654efc7755aa433247b63228ce237a97f9eb29bfb74d0b602acd
CryptOne
1a37f5980dfaccf82f357074e3d3013e6280e14ddb291ff49b539393daa9da6d
CryptOne
2709f083327060b896501645e3263462cf0e329645e41f6d4556276904c51856
CryptOne
301a3e665000c99ab655a74dbf9408de24875866528be4f6d28e83490c19305b
CryptOne
3a0597925d2b7686d2386591f60a7abe686c0e10e2e164405270cc0d83e4b128
CryptOne
51986665322a79945ae565a363862e8007b3be459855f27c11c062da0eb59db8
CryptOne
7571b1e23ad03a0ce6c5a1dd2593eb01bb7ffcf42e192d4e0cfef32ce493609e
CryptOne
c787c9a5f407a656478efc835f1a0f8f738030bf26cedbd4748cb7b18ed2ea3e
CryptOne
e9f669028697238e2a9a181b9e409909695d03eccd09a35db30729fb51952527
CryptOne
+ 1'920 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221111-mdpwcsee42/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/33416f73-dcbc-492a-854d-678b0bdbb97d
Unpacked files
SH256 hash:
03f0f625beee5e06cc2e8f6ce3c65b39661df8b4bb38893b3332a182a8bc1d54
MD5 hash:
1bb2e1a7736180f1f9a9483c2f4a20b5
SHA1 hash:
9431599e678ecdfc1e84e7859029fdd51a058346
Link:
https://www.unpac.me/results/3d2c0c34-18e5-40ca-b47f-60ca347a0576/
SH256 hash:
acbb7c1b2929a9556d6629ce4fcd6b16a5d1418d767bd24543dc9b432682ce4c
MD5 hash:
766a8d5758ec27e4a288e7ba2ea1cd99
SHA1 hash:
a925e140d978edf92b6836c077f7ff90ba1a8927
Link:
https://www.unpac.me/results/3d2c0c34-18e5-40ca-b47f-60ca347a0576/
SH256 hash:
62ffc5fabaf9853f0b3821f6dffbb876c7d38f7f68d4b7d14b9fc4fc0fddc36d
MD5 hash:
b43daa9d1f879fc8ba3718dcfa063c19
SHA1 hash:
f3e3e279bb6e1df1c8748ee4e6bc30b6256c7925
Link:
https://www.unpac.me/results/3d2c0c34-18e5-40ca-b47f-60ca347a0576/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/62ffc5fabaf9853f0b3821f6dffbb876c7d38f7f68d4b7d14b9fc4fc0fddc36d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptOne

Executable exe 62ffc5fabaf9853f0b3821f6dffbb876c7d38f7f68d4b7d14b9fc4fc0fddc36d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2405501/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/332416/

Comments