MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d378f7453afa34ebcbc642d1126b7b9e23fe1ec0b459916000dfd5a0593050d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptOne


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d378f7453afa34ebcbc642d1126b7b9e23fe1ec0b459916000dfd5a0593050d
SHA3-384 hash: 483ba0c891fcd123c489e3ebc366bf8f1daec5faed396c312911f07a60d684574d4a5d135d253cef932703c7768000b9
SHA1 hash: f8a8f9fc2c1a39ae67a0232e68f1afb920de0f9b
MD5 hash: df52194011782bafe9f08838a4136694
humanhash: pizza-kentucky-bakerloo-don
File name:file
Download: download sample
Signature CryptOne
Create hunting rule
File size:1'845'932 bytes
First seen:2022-11-14 19:58:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ae9f6a32bb8b03dce37903edbc855ba1 (28 x CryptOne, 18 x RedLineStealer, 15 x njrat)
ssdeep 49152:KyFNk+bwhsuG8cHniHYjo8HqP8cLapcJ7HA58RBdS:KyFNk4wQDHnCSo8m8RKgyRBdS
Threatray 2'339 similar samples on MalwareBazaar
TLSH T1408523217AC49572D53128748DDDE3A0593C7D115F38EFDB63A86A2E4E301C0EA3AB67
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter jstrosch
Tags:CryptOne exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-14 19:59:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5525d98a-4c9c-40f9-bb11-156145450b8e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/333917/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.44081008.21193.10752.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Creating a window
Searching for the window
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/52435/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/63729e0807c3f5e84a012203/reports/eace9edd-13be-49be-ad89-120713fe3c38/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/990624e8-10af-41ac-bd01-ce2807a67a50
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1113234
Signature
Machine Learning detection for dropped file
Machine Learning detection for sample
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 745930 Sample: file.exe Startdate: 14/11/2022 Architecture: WINDOWS Score: 56 22 Yara detected CryptOne packer 2->22 24 Machine Learning detection for sample 2->24 26 Machine Learning detection for dropped file 2->26 9 file.exe 3 8 2->9         started        process3 file4 20 C:\Users\user\AppData\Local\...\pwxLDMu.cpl, PE32 9->20 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        process7 16 rundll32.exe 14->16         started        process8 18 rundll32.exe 16->18         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d378f7453afa34ebcbc642d1126b7b9e23fe1ec0b459916000dfd5a0593050d/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-11-14 19:59:14 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nu3y65ctv6ru5pf4mqwrcjvxxhrd7ypmbnczsfqabx6vubmtaugq._file
Verdict:
malicious
Similar samples:
38066ee9fea009a8a6c2575e1a05fadd49a2cfe205dd8a6604eea85f5c7a42bd
CryptOne
40156767b7c2d016c2727e539746c2b8dcb89ef8b535a6815cec5b0b39197bd4
CryptOne
5bd7a1d3894b770b58190bfb3c6020344ce47389ccdc5b080cff9d23718ff4b3
CryptOne
6a42f7e5290bf7e40e1aa0c0e9ceda098a612d6dda9b7fa613e0c3a58b16b826
CryptOne
7aa19913253d9a036b10df1f8f0bdb25567edda11fe99050d85a47249142bec2
CryptOne
8629c6d83161280020e6f02a08da3b29b5eed6a19717b03c021048e9b57b8ef9
CryptOne
db5d4a5090c7303616f88db08a22abc975804ae1abdef9740c208c004648255b
CryptOne
f517c9576d21eb344a419f39255d835248e794b1b2d4951a0bbe185f20a04c4c
CryptOne
+ 2'329 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221114-yqd56shf7x/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/c2ff288c-8914-4179-aa0f-33a58a6f91d4
Unpacked files
SH256 hash:
7bfd18cfe1c1ff476b625e7ec0ad28e01146468983ed68a18394353b6664ff53
MD5 hash:
532c26f1520e247461d2469ffa1d352d
SHA1 hash:
65d6f49997c3693a038cb34a55232f5bae0400ef
Link:
https://www.unpac.me/results/c1aefe61-c3e4-4024-80dd-ec37a2dc1bde/
SH256 hash:
1c550c3d0c9f3c28ea17d0ee0d3e32d3e86e73e4388522fd6fb823d9ff341ed2
MD5 hash:
93c83f3c221ba594df831d57c1c8e5e4
SHA1 hash:
265eae34b36f99a37216aaaa7e8fb1f4ab556396
Link:
https://www.unpac.me/results/c1aefe61-c3e4-4024-80dd-ec37a2dc1bde/
SH256 hash:
6d378f7453afa34ebcbc642d1126b7b9e23fe1ec0b459916000dfd5a0593050d
MD5 hash:
df52194011782bafe9f08838a4136694
SHA1 hash:
f8a8f9fc2c1a39ae67a0232e68f1afb920de0f9b
Link:
https://www.unpac.me/results/c1aefe61-c3e4-4024-80dd-ec37a2dc1bde/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6d378f7453afa34ebcbc642d1126b7b9e23fe1ec0b459916000dfd5a0593050d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptOne

Executable exe 6d378f7453afa34ebcbc642d1126b7b9e23fe1ec0b459916000dfd5a0593050d

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/333917/

Comments