MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69ba1e841933539403aedc15b34736c76a0dd6cb4874d262f29bce1fa3493d1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptoJoker


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69ba1e841933539403aedc15b34736c76a0dd6cb4874d262f29bce1fa3493d1c
SHA3-384 hash: 7744ee86c206809b102fe52d4f1d5c6c47fd24b2fae5e556640e6ce74427e5be322dce8ffd66eda6e4e283afd04d9f9c
SHA1 hash: d6576499d19b1cfd9a10d1fcff583d142e564ed2
MD5 hash: 4540175bcec2b3d8c064d46bdc2cd44f
humanhash: one-idaho-winner-kitten
File name:Trojan-Ransom.MSIL.Agent.gog-69ba1e841933539403aedc15b34736c76a0dd6cb4874d262f29bce1fa3493d1c
Download: download sample
Signature CryptoJoker
Create hunting rule
File size:658'944 bytes
First seen:2022-04-19 17:02:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:xSKwjzsZpds2JbrpolSKwjzuZpXs2JTypo:xSKwWes6lSKw88s/
Threatray 1 similar samples on MalwareBazaar
TLSH T120E4D05677548673C8798A76E816C2710F30EEBCDB52C31B79C1726F3CBA7608A42B52
TrID 69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 88e47438ece4c620 (1 x CryptoJoker)
Reporter petikvx
Tags:CryptoJoker cryptonar exe Ransomware

Intelligence

File Origin
# of uploads :
1
# of downloads :
440
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Kaspersky_Trial_Reset
Verdict:
Malicious activity
Analysis date:
2018-09-03 06:51:38 UTC
Tags:
ransomware
Link:
https://app.any.run/tasks/f1b94c98-a174-4f9a-97ce-08059b6313e0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/264669/
Detection(s):
Win.Ransomware.Hiddentear-9867653-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Adding an access-denied ACE
Changing a file
Modifying an executable file
Reading critical registry keys
Creating a file
Moving a recently created file
Creating a file in the %temp% directory
Moving a file to the %temp% directory
Moving a file to the %AppData% subdirectory
Replacing files
Creating a file in the %AppData% subdirectories
Creating a file in the %AppData% directory
Using the Windows Management Instrumentation requests
Stealing user critical data
Encrypting user's files
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm cryptojoker cryptonar filecoder hiddentear obfuscated packed ransomware replace.exe
Link:
https://www.filescan.io/uploads/625eeb48ffe27d51190de7a1/reports/e3ffd374-1f6e-4361-9975-b9a5f356ce19/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CryptoNar
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f10795d1-fed1-4da0-8258-71a9028da8cb
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/979015
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69ba1e841933539403aedc15b34736c76a0dd6cb4874d262f29bce1fa3493d1c/
Threat name:
ByteCode-MSIL.Ransomware.Crypcryptojoker
Create hunting rule
Status:
Malicious
First seen:
2018-08-22 19:12:48 UTC
File Type:
PE (.Net Exe)
Extracted files:
28
AV detection:
31 of 39 (79.49%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ng5b5bazgnjzia5o3qk3grzwy5va3vwljb2neyxstphb7i2jhuoa._file
Verdict:
malicious
Similar samples:
90618d3aa5146d27b46476a4c7bfcc2e5323b74dcbcf2c0af6b4f00c4c2d9297
CryptoJoker
Result
Malware family:
n/a
Score:
  10/10
Tags:
ransomware spyware stealer
Link:
https://tria.ge/reports/220419-vknwmsade8/
Behaviour
Suspicious use of AdjustPrivilegeToken
Drops desktop.ini file(s)
Drops startup file
Reads user/profile data of web browsers
Modifies extensions of user files
Unpacked files
SH256 hash:
69ba1e841933539403aedc15b34736c76a0dd6cb4874d262f29bce1fa3493d1c
MD5 hash:
4540175bcec2b3d8c064d46bdc2cd44f
SHA1 hash:
d6576499d19b1cfd9a10d1fcff583d142e564ed2
Link:
https://www.unpac.me/results/ed29ca24-9de4-4dc8-b3f4-3c3a94468a82/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/69ba1e841933539403aedc15b34736c76a0dd6cb4874d262f29bce1fa3493d1c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/264669/

Comments