MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 743f92678d29a5338b7b276226b0d8f60749589f1b11789f40b292d4f2ce7854. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
CryptBot
Vendor detections: 10
| SHA256 hash: | 743f92678d29a5338b7b276226b0d8f60749589f1b11789f40b292d4f2ce7854 |
|---|---|
| SHA3-384 hash: | c4063f8b1a36e429d195f003ef9440c7152c9829c9fae506b16c074e8af108290f38df248783ababdf4cf46c329e0423 |
| SHA1 hash: | f738f6a5f1b6ec1b90289b4ab02b8b44d5f54c0a |
| MD5 hash: | c06a3a89d83eced416d931b07081b66e |
| humanhash: | mirror-august-indigo-one |
| File name: | c06a3a89d83eced416d931b07081b66e.exe |
| Download: | download sample |
| Signature | CryptBot |
| File size: | 2'291'098 bytes |
| First seen: | 2021-03-27 07:17:40 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | be41bf7b8cc010b614bd36bbca606973 (195 x LummaStealer, 126 x DanaBot, 63 x Vidar) |
| ssdeep | 49152:YC0119qqQRvJVAxTPnTmpoRMJtMVfH0eXoKrp2VOVPC4l5VxR:b0H9JkzcnapGMJyfUeXo3qb3R |
| Threatray | 85 similar samples on MalwareBazaar |
| TLSH | ACB533C95E6EE52ACC4692B59EB5E8D341A63C30BC60ED67A7321ECF7D135011831BA3 |
| Reporter |  abuse_ch |
| Tags: | CryptBot exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
252
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PTC-Mathcad-Prime-60-Full-Crack-Latest-Version-Free-Download-2021_784abbcb500086569f750e.zip
Verdict:
Malicious activity
Analysis date:
2021-03-26 22:41:58 UTC
Tags:
autoit stealer trojan loader evasion
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Deleting a recently created file
Creating a file in the %AppData% subdirectories
Launching a process
Creating a process with a hidden window
Running batch commands
Launching cmd.exe command interpreter
Sending a UDP request
DNS request
Sending an HTTP GET request
Creating a file
Sending a custom TCP request
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
IntelRapid
Verdict:
Malicious
Result
Threat name:
Cryptbot
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Contains functionality to register a low level keyboard hook
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Sigma detected: Suspicious Svchost Process
Submitted sample is a known malware sample
System process connects to network (likely due to code injection or exploit)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Cryptbot
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Wacatac
Status:
Malicious
First seen:
2021-03-26 19:17:27 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 75 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
spyware stealer
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
Unpacked files
SH256 hash:
a56d515897f4d9d336602a1809949629f0e79e1fa0d55154b3b1121fb6138085
MD5 hash:
b3d3f51c4249eeaa7d5245ea4f8c7460
SHA1 hash:
2a3627e3aeeab195eec76c2a65394d178c954f9f
SH256 hash:
70aad9b1eaee136651bca2e45491e49628e3a1ca7400dc2edaa72a8365bad042
MD5 hash:
85ea9bf537f3b2d01b1b935d0f75337d
SHA1 hash:
f79c426cb4f91a8a909ad0ca91a6c69713894ef3
SH256 hash:
a2d895a4a913cca917982d54435fe945d9095dbf70baf71f479da6deb72daac7
MD5 hash:
79e8d546a0c8b9fe71550a1b9a2168df
SHA1 hash:
d06b7af30592aefb1e840e87cba298bdfb36761d
SH256 hash:
743f92678d29a5338b7b276226b0d8f60749589f1b11789f40b292d4f2ce7854
MD5 hash:
c06a3a89d83eced416d931b07081b66e
SHA1 hash:
f738f6a5f1b6ec1b90289b4ab02b8b44d5f54c0a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.