MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 719cf0c9eba47af19500753dc4213f551efdc09f13e2c71ef0e39b08a7aca888. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cryptbot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 719cf0c9eba47af19500753dc4213f551efdc09f13e2c71ef0e39b08a7aca888
SHA3-384 hash: bfe3b019c8e7aa8699977c7c6faee61ca73bb55588b7bbb582b786f0d2992bff3d1ffe90c94f3c821174e252189b2752
SHA1 hash: c502b3e3d5e1859e1089a5e1b09f7b8d0a44dc7b
MD5 hash: 5cbbdb7bab881f319d1f54c8c76cb4ae
humanhash: bacon-gee-mountain-papa
File name:5cbbdb7bab881f319d1f54c8c76cb4ae.exe
Download: download sample
Signature Cryptbot
Create hunting rule
File size:1'370'394 bytes
First seen:2021-07-15 09:43:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar)
ssdeep 24576:YklijGktQy61Z/rZfk+9iS3A/QjqOFOwbAOfC4WT4ODhgi8mcRM+ziCF:dltsh61Z/rFHO/OFOrOfFzO/IRNzHF
Threatray 331 similar samples on MalwareBazaar
TLSH T1F255234267A9C937F4121579BB768A8B57B36D048924EF6F9204BF8DB433141C3A07AF
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
58fa567894c7dc28d2b7f0d7f3886512.exe
Verdict:
Malicious activity
Analysis date:
2021-07-15 09:55:56 UTC
Tags:
stealer trojan loader
Link:
https://app.any.run/tasks/2359b12f-f245-4a6c-a0ce-7d609c7cf9e4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/171936/
Detection(s):
Win.Packed.Filerepmalware-9864117-0
Create hunting rule

Win.Packed.Stop-9872858-0
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
IntelRapid
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5fccb994-a2cb-46e4-b3d9-2bbf81f4b5de
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/816821
Signature
Contains functionality to register a low level keyboard hook
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Submitted sample is a known malware sample
System process connects to network (likely due to code injection or exploit)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Clipboard Hijacker
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 449231 Sample: kTZXhaf3zY.exe Startdate: 15/07/2021 Architecture: WINDOWS Score: 100 76 Found malware configuration 2->76 78 Multi AV Scanner detection for dropped file 2->78 80 Multi AV Scanner detection for submitted file 2->80 82 8 other signatures 2->82 11 kTZXhaf3zY.exe 25 2->11         started        14 SmartClock.exe 2->14         started        16 SmartClock.exe 2->16         started        process3 file4 54 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 11->54 dropped 56 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 11->56 dropped 58 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 11->58 dropped 60 3 other files (none is malicious) 11->60 dropped 18 vpn.exe 7 11->18         started        20 4.exe 4 11->20         started        process5 file6 23 cmd.exe 1 18->23         started        50 C:\Users\user\AppData\...\SmartClock.exe, PE32 20->50 dropped 26 SmartClock.exe 20->26         started        process7 signatures8 84 Submitted sample is a known malware sample 23->84 86 Obfuscated command line found 23->86 88 Uses ping.exe to sleep 23->88 90 Uses ping.exe to check the status of other devices and networks 23->90 28 cmd.exe 3 23->28         started        31 conhost.exe 23->31         started        process9 signatures10 92 Obfuscated command line found 28->92 94 Uses ping.exe to sleep 28->94 33 Ricordarti.exe.com 28->33         started        36 PING.EXE 1 28->36         started        39 findstr.exe 1 28->39         started        process11 dnsIp12 74 May check the online IP address of the machine 33->74 42 Ricordarti.exe.com 3 18 33->42         started        64 127.0.0.1 unknown unknown 36->64 66 192.168.2.1 unknown unknown 36->66 52 C:\Users\user\AppData\...\Ricordarti.exe.com, Targa 39->52 dropped file13 signatures14 process15 dnsIp16 68 ip-api.com 208.95.112.1, 49723, 80 TUT-ASUS United States 42->68 70 LMwWfCcmRWAmfFCNIZdgWmiWmFe.LMwWfCcmRWAmfFCNIZdgWmiWmFe 42->70 62 C:\Users\user\AppData\...\qtnipqcpwq.vbs, ASCII 42->62 dropped 46 wscript.exe 12 42->46         started        file17 process18 dnsIp19 72 iplogger.org 88.99.66.31, 443, 49724 HETZNER-ASDE Germany 46->72 96 System process connects to network (likely due to code injection or exploit) 46->96 98 May check the online IP address of the machine 46->98 signatures20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/719cf0c9eba47af19500753dc4213f551efdc09f13e2c71ef0e39b08a7aca888/
Threat name:
Win32.Trojan.Crypzip
Create hunting rule
Status:
Malicious
First seen:
2021-07-14 19:58:59 UTC
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ogopbsplur5pdfiaou64iij7kupp3qe7cprmohxq4onqrj5mvcea._file
Verdict:
malicious
Similar samples:
12f0a80b6374b38a3997a7ef4528f26ccbca664b26e48533e7d1f36c78da76f4
Cryptbot
473574ab9286caa551c88e2a3ac32e8b7975baac765bf084fd8c6ccb89737666
Cryptbot
4bc74f0c9c8b45502fa4989b3e25808db909cf5239034951b6ab343d90678470
Cryptbot
743f92678d29a5338b7b276226b0d8f60749589f1b11789f40b292d4f2ce7854
Cryptbot
90ac0149296d9e41ed0cac8e96866f26e60b7585f75dddff13f67136ef694b63
Cryptbot
97d497e3e5e60db871dfde169070847b7067fcd409f9dbed19584c3b64ac9ac9
Cryptbot
9e7dfceb92306a6a5f8317840bd2614130973d14c04a88e4bf5a755b583e4ccb
Cryptbot
af8df57ba3941ed8fa89543e4e98f2da5dfe7a0efaaa72aaca4c54ea9f5ccc58
Cryptbot
c3fd41da298b657f36085d828012a94c9979400b753c028eb26d0a6fb50b05bb
Cryptbot
df85a38611751933558ef9e7da81e81025ffc5e5e92cedaf4d97fb0b9f147422
Cryptbot
+ 321 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210715-hvxj6xtcsa/
Behaviour
Checks processor information in registry
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
cae2af36f866fed9753ecc423bf1cfb3d1b5f2c3179dddc1715d6c896812d669
MD5 hash:
0fcc3d7408dfb7b31d8e36982dab298c
SHA1 hash:
6ebe13e8565ab5cfc7f8eac8973c156531b2a1e2
Link:
https://www.unpac.me/results/572f1e5c-2b88-4ac9-9155-00f94b58ac58/
SH256 hash:
a4d86b0d70cd81b011e2f5dfe0f078a4dc4e35c55aebf1eff2f82bacabae9ee3
MD5 hash:
3292e786e45593f70feaccecde0fc997
SHA1 hash:
a76a6d6feb9b53968f67646a51dd3b7ea617bf2f
Link:
https://www.unpac.me/results/572f1e5c-2b88-4ac9-9155-00f94b58ac58/
SH256 hash:
1cbc77c3a234fd3d743e46f58f3f188f1558c1fa0531cd13e19162a5a9187133
MD5 hash:
1aa9bae4c0bd7b5b90c574b8b0663ec9
SHA1 hash:
36b3c0b2eaa6ae73e79bf086a4a513941f639a74
Link:
https://www.unpac.me/results/572f1e5c-2b88-4ac9-9155-00f94b58ac58/
SH256 hash:
719cf0c9eba47af19500753dc4213f551efdc09f13e2c71ef0e39b08a7aca888
MD5 hash:
5cbbdb7bab881f319d1f54c8c76cb4ae
SHA1 hash:
c502b3e3d5e1859e1089a5e1b09f7b8d0a44dc7b
Link:
https://www.unpac.me/results/572f1e5c-2b88-4ac9-9155-00f94b58ac58/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/719cf0c9eba47af19500753dc4213f551efdc09f13e2c71ef0e39b08a7aca888

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Cryptbot

Executable exe 719cf0c9eba47af19500753dc4213f551efdc09f13e2c71ef0e39b08a7aca888

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1453978/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/171936/

Comments