MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 705b09578c6785adb9c29b9d9e5c57fe8c3892ec6cc0a04b099d205a1794aaf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cryptbot


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 705b09578c6785adb9c29b9d9e5c57fe8c3892ec6cc0a04b099d205a1794aaf7
SHA3-384 hash: ce1a3213312918d423f0629847d14426852bc9a967358d0214e507a5343b135f6a9ace42f8bea5545d2cafd75bf5c115
SHA1 hash: ce8051411562c03c37eaa0d3029338a87bb47b2e
MD5 hash: e812e01d1bac0e579d9758e61383efd8
humanhash: queen-black-mississippi-december
File name:e812e01d1bac0e579d9758e61383efd8.exe
Download: download sample
Signature Cryptbot
Create hunting rule
File size:1'229'839 bytes
First seen:2021-07-16 18:48:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep 24576:Za1ZoefTY3tmKNxMU35hgqjcuVnRGF1Rz1Q3NLnZeCiOunE+UPVMN:81Zoa89LMU59PeQ3WCKnZfN
Threatray 351 similar samples on MalwareBazaar
TLSH T12F45239179E0C169E5680FB0593B9373BB3EE5334810E719D30A8D8E3B64473CA25B6B
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Main-lnstall-v5.7.exe.7z
Verdict:
Malicious activity
Analysis date:
2021-07-16 18:22:25 UTC
Tags:
stealer trojan loader evasion
Link:
https://app.any.run/tasks/54a7cf07-ba3d-4470-aa3d-fc0ebaaf38b9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172248/
Detection(s):
Win.Packed.Filerepmalware-9864117-0
Create hunting rule

Win.Packed.Stop-9872858-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
IntelRapid
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1cbb53bc-b62c-42f7-9dd9-82fce617c4ae
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/817652
Signature
Contains functionality to register a low level keyboard hook
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Submitted sample is a known malware sample
System process connects to network (likely due to code injection or exploit)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Clipboard Hijacker
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 450063 Sample: K9syw3kor1.exe Startdate: 16/07/2021 Architecture: WINDOWS Score: 100 74 Found malware configuration 2->74 76 Multi AV Scanner detection for dropped file 2->76 78 Multi AV Scanner detection for submitted file 2->78 80 9 other signatures 2->80 11 K9syw3kor1.exe 25 2->11         started        14 SmartClock.exe 2->14         started        16 SmartClock.exe 2->16         started        process3 file4 54 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 11->54 dropped 56 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 11->56 dropped 58 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 11->58 dropped 60 3 other files (none is malicious) 11->60 dropped 18 vpn.exe 7 11->18         started        20 4.exe 4 11->20         started        process5 file6 23 cmd.exe 1 18->23         started        50 C:\Users\user\AppData\...\SmartClock.exe, PE32 20->50 dropped 26 SmartClock.exe 20->26         started        process7 signatures8 82 Submitted sample is a known malware sample 23->82 84 Obfuscated command line found 23->84 86 Uses ping.exe to sleep 23->86 88 Uses ping.exe to check the status of other devices and networks 23->88 28 cmd.exe 3 23->28         started        31 conhost.exe 23->31         started        process9 signatures10 90 Obfuscated command line found 28->90 92 Uses ping.exe to sleep 28->92 33 Smorta.exe.com 28->33         started        36 PING.EXE 1 28->36         started        39 findstr.exe 1 28->39         started        process11 dnsIp12 72 May check the online IP address of the machine 33->72 42 Smorta.exe.com 3 19 33->42         started        64 127.0.0.1 unknown unknown 36->64 52 C:\Users\user\AppData\...\Smorta.exe.com, Targa 39->52 dropped file13 signatures14 process15 dnsIp16 66 ip-api.com 208.95.112.1, 49733, 80 TUT-ASUS United States 42->66 68 UTTHxeXMrRzwq.UTTHxeXMrRzwq 42->68 62 C:\Users\user\AppData\...\csxrqrtjjmah.vbs, ASCII 42->62 dropped 46 wscript.exe 12 42->46         started        file17 process18 dnsIp19 70 iplogger.org 88.99.66.31, 443, 49735 HETZNER-ASDE Germany 46->70 94 System process connects to network (likely due to code injection or exploit) 46->94 96 May check the online IP address of the machine 46->96 signatures20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/705b09578c6785adb9c29b9d9e5c57fe8c3892ec6cc0a04b099d205a1794aaf7/
Threat name:
Win32.Trojan.Crypzip
Create hunting rule
Status:
Malicious
First seen:
2021-07-16 18:49:03 UTC
AV detection:
21 of 46 (45.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=obnqsv4mm6c23ooctooz4xcx72gdrexmntakasyjtuqfuf4uvl3q._file
Verdict:
suspicious
Similar samples:
54f791796231f7899d753f0ba44e7387bf7748dc7a28adbd28f2067c9ab88605
Cryptbot
719cf0c9eba47af19500753dc4213f551efdc09f13e2c71ef0e39b08a7aca888
Cryptbot
743f92678d29a5338b7b276226b0d8f60749589f1b11789f40b292d4f2ce7854
Cryptbot
7e19416205cfb8e056d4628bdeb635e29cefba04fcb21ee55e7b0077427e4c99
Cryptbot
949b755ce7ba4afeffe8c261141b77bca5f443761aa062936141ed94b737e848
Cryptbot
af8df57ba3941ed8fa89543e4e98f2da5dfe7a0efaaa72aaca4c54ea9f5ccc58
Cryptbot
+ 341 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210716-jd3de8a29a/
Behaviour
Checks processor information in registry
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
cae2af36f866fed9753ecc423bf1cfb3d1b5f2c3179dddc1715d6c896812d669
MD5 hash:
0fcc3d7408dfb7b31d8e36982dab298c
SHA1 hash:
6ebe13e8565ab5cfc7f8eac8973c156531b2a1e2
Link:
https://www.unpac.me/results/0e10cf3e-561d-4bbb-a657-81d7743bc31d/
SH256 hash:
436ccd5923273f92a8beb79cdaea63ef395e921c674b6750eef91c2f33e939d8
MD5 hash:
a549cd25055104a98a267f303443de78
SHA1 hash:
6e6cff6e9055deff68f30bfdd9b6c556fa0f5f2e
Link:
https://www.unpac.me/results/0e10cf3e-561d-4bbb-a657-81d7743bc31d/
SH256 hash:
6b2f20f2bdbd6c9e8b5aa7efd23e7341c9a466bf4997b31390075abfe0944f03
MD5 hash:
af0fcc408931ae05c9651059f0c446d3
SHA1 hash:
7e4ce37dc0b350e71e32181beee3093b5c9e8dac
Link:
https://www.unpac.me/results/0e10cf3e-561d-4bbb-a657-81d7743bc31d/
SH256 hash:
705b09578c6785adb9c29b9d9e5c57fe8c3892ec6cc0a04b099d205a1794aaf7
MD5 hash:
e812e01d1bac0e579d9758e61383efd8
SHA1 hash:
ce8051411562c03c37eaa0d3029338a87bb47b2e
Link:
https://www.unpac.me/results/0e10cf3e-561d-4bbb-a657-81d7743bc31d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/705b09578c6785adb9c29b9d9e5c57fe8c3892ec6cc0a04b099d205a1794aaf7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Cryptbot

Executable exe 705b09578c6785adb9c29b9d9e5c57fe8c3892ec6cc0a04b099d205a1794aaf7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1458756/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/172248/

Comments