MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 666be9b4c4842a088d58cb60056335bab68c1745aef6ef843d0506a35cc7484e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptOne


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 666be9b4c4842a088d58cb60056335bab68c1745aef6ef843d0506a35cc7484e
SHA3-384 hash: e67e5a7c1249a2238c1e032557307cb44f4f065a3f145b9cd26f6bf1356ffa6ce4a7ba921ab97d28e4a9a17f810bdeb0
SHA1 hash: aaca9d36f6d80254010a8f8d54277bba32b7cf85
MD5 hash: e85810d123be530389aa68e39c67e7e8
humanhash: delta-nebraska-hawaii-ack
File name:e85810d123be530389aa68e39c67e7e8.exe
Download: download sample
Signature CryptOne
Create hunting rule
File size:1'470'337 bytes
First seen:2022-11-06 17:28:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ae9f6a32bb8b03dce37903edbc855ba1 (28 x CryptOne, 18 x RedLineStealer, 15 x njrat)
ssdeep 24576:zry2uXzmwLylf87XWHQtSK5PDrqU0QpQ1lEXs/cK0EiunGue6SwChKxA/P1y:zunwSXPdnq3fEzEi36SwChCA/M
Threatray 1'966 similar samples on MalwareBazaar
TLSH T1576512127AC18531C571193986FA9B74A838BC311F35CA9FD3947A2D1E301D2BA3A7B7
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter abuse_ch
Tags:CryptOne exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
162
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e85810d123be530389aa68e39c67e7e8.exe
Verdict:
Malicious activity
Analysis date:
2022-11-06 17:29:42 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f7cb898f-c579-4660-b460-d44fd7dd7eac

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/329519/
Detection(s):
SecuriteInfo.com.Trojan.Uztuby.4.21386.15255.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/49325/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/6367eedf3c6c57b4ec414424/reports/642446ec-e538-492d-a001-97db7e71234c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/4d80a36d-361e-4fa6-9d31-191318342d54
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1106693
Signature
Antivirus detection for dropped file
Contains functionality to detect sleep reduction / modifications
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 739357 Sample: uAZ91khTUV.exe Startdate: 06/11/2022 Architecture: WINDOWS Score: 84 23 Antivirus detection for dropped file 2->23 25 Multi AV Scanner detection for dropped file 2->25 27 Multi AV Scanner detection for submitted file 2->27 29 3 other signatures 2->29 9 uAZ91khTUV.exe 8 2->9         started        process3 file4 21 C:\Users\user\AppData\Local\Temp\nFMqvk.5, PE32 9->21 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        signatures7 31 Contains functionality to detect sleep reduction / modifications 14->31 17 rundll32.exe 14->17         started        process8 process9 19 rundll32.exe 17->19         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/666be9b4c4842a088d58cb60056335bab68c1745aef6ef843d0506a35cc7484e/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-11-06 14:29:32 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
27 of 42 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mzv6tngeqqvardkyznqakyzvxk3iyf2fv33o7bb5audkgxghjbha._file
Verdict:
malicious
Similar samples:
190f4fb1b115015c5953c32d83b90e4574b371611ca78f6d37f6c0839b7be9b5
CryptOne
2df4e3a4d7b6e5f33ef54c73ff86ffc76d8667ff587756a2887bf91687ab46a9
CryptOne
56f958f289d5af36088cf03190de09be80dc84e6bb71b5b9ab6439c9e7f1152d
CryptOne
bf714f661724be71712eba1e8c6660a08e39b2deb3aaa09631fc568ebf7c0d83
CryptOne
c3bd2da0149a8c2a98a4e8ec4d8ca2fcadd1be76a6cc99850babaca6ff6fbb27
CryptOne
dd2a5dcb0106f4c6e7b91ececccef95ff651daa95d78210d41287fe1de0cb639
CryptOne
f19dff408fd65268a61ec79e52e8c19780d7364b20560eac8a09f12d14487e19
CryptOne
+ 1'956 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221106-v2jm9adch7/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/726c889c-3b4c-4ffb-951e-18e01d7bb7a8
Unpacked files
SH256 hash:
2c69fd46c8decbf416673286a983fb020d25d5d39d30c35f2526ff7618ed03fc
MD5 hash:
51b0b6979f1d80d0f68a78fa08ff978d
SHA1 hash:
dd829d6733bf8238b203699ac44ce67fac43b4df
Link:
https://www.unpac.me/results/e63faa66-4716-401e-970f-15dae16e5917/
SH256 hash:
fc44a363285e8105db96b08f1d30cdfcb8d741ba23ae0f5734ca5c9a1d87f0bc
MD5 hash:
326cf79125aa8ec967f03d59ae678aa4
SHA1 hash:
7aa157df94b8427e29d0881c3295b36749d0d0c6
Link:
https://www.unpac.me/results/e63faa66-4716-401e-970f-15dae16e5917/
SH256 hash:
666be9b4c4842a088d58cb60056335bab68c1745aef6ef843d0506a35cc7484e
MD5 hash:
e85810d123be530389aa68e39c67e7e8
SHA1 hash:
aaca9d36f6d80254010a8f8d54277bba32b7cf85
Link:
https://www.unpac.me/results/e63faa66-4716-401e-970f-15dae16e5917/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/666be9b4c4842a088d58cb60056335bab68c1745aef6ef843d0506a35cc7484e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptOne

Executable exe 666be9b4c4842a088d58cb60056335bab68c1745aef6ef843d0506a35cc7484e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2401723/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/329519/

Comments