MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76386b4c6c46b36b26d9ce00df7982d461bcd1a7586dde62cd831349d0aa3a4b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 11


Intelligence 11 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76386b4c6c46b36b26d9ce00df7982d461bcd1a7586dde62cd831349d0aa3a4b
SHA3-384 hash: c4bdae44a4993bc0f22d96aca69db93668eebb00f47f5fe923d21ec014ea53237fe6a031d29ca541a26c9b0b8abbed85
SHA1 hash: e97629c48229194c49ccbf08ac765afaf4740bfa
MD5 hash: c64c77ce0a7548d644d3d79ec798bdf9
humanhash: nine-september-carpet-carbon
File name:c64c77ce0a7548d644d3d79ec798bdf9.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:654'336 bytes
First seen:2021-03-29 13:52:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2303a211a700e7d2299a8174d4e0e2e4 (1 x CryptBot)
ssdeep 12288:IpNxwKT5fFRtD17qMMMmKKayotBZnFKDA20l37pv/KmyxmCGQDTVSXuzmzHub:Ifft17bjtrn8DA2k37pvSlGQDTVS+qH
Threatray 101 similar samples on MalwareBazaar
TLSH 8ED41221F5E2C033E54219754821D2B28D76FC765B316BC737943B6A9E3A2E38B32356
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c64c77ce0a7548d644d3d79ec798bdf9.exe
Verdict:
Malicious activity
Analysis date:
2021-03-29 14:14:30 UTC
Tags:
trojan stealer loader
Link:
https://app.any.run/tasks/ec78cb06-e739-4234-8bf4-ffe302b1b75f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/127609/
Detection(s):
Win.Malware.Generickdz-9848021-0
Create hunting rule

Win.Ransomware.Gandcrypt-9848025-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Launching a process
Launching cmd.exe command interpreter
Sending a custom TCP request
Sending a UDP request
Creating a file in the %temp% directory
Deleting a recently created file
Creating a file
Delayed reading of the file
Reading critical registry keys
Creating a window
Stealing user critical data
Launching the process to create tasks for the scheduler
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CryptBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9fe2529e-7bf6-47f0-9eb3-5dff65edc0e5
Result
Threat name:
Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/656989
Signature
Contains functionality to register a low level keyboard hook
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 377440 Sample: IaYA2iuuIV.exe Startdate: 29/03/2021 Architecture: WINDOWS Score: 100 81 VusOuzFtqFJiYoAyLfmjtXMY.VusOuzFtqFJiYoAyLfmjtXMY 2->81 83 CCwHJWTVlHPdA.CCwHJWTVlHPdA 2->83 85 2 other IPs or domains 2->85 97 Malicious sample detected (through community Yara rule) 2->97 99 Multi AV Scanner detection for dropped file 2->99 101 Multi AV Scanner detection for submitted file 2->101 103 10 other signatures 2->103 11 IaYA2iuuIV.exe 50 2->11         started        16 SmartClock.exe 2->16         started        18 SmartClock.exe 2->18         started        signatures3 process4 dnsIp5 87 binsas01.top 35.242.170.33, 49724, 49725, 80 GOOGLEUS United States 11->87 89 cinswi12.top 34.65.191.195, 49722, 49723, 80 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 11->89 91 morsxd01.top 11->91 75 C:\Users\user\AppData\Local\Temp\Fibro.exe, PE32 11->75 dropped 77 C:\Users\user\AppData\Local\...\lv[1].exe, PE32 11->77 dropped 113 Detected unpacking (changes PE section rights) 11->113 115 Detected unpacking (overwrites its own PE header) 11->115 117 Tries to harvest and steal browser information (history, passwords, etc) 11->117 20 Fibro.exe 20 11->20         started        24 cmd.exe 1 11->24         started        file6 signatures7 process8 file9 67 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 20->67 dropped 69 C:\Users\user\AppData\Local\Temp\...\6.exe, PE32 20->69 dropped 71 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 20->71 dropped 73 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 20->73 dropped 105 Multi AV Scanner detection for dropped file 20->105 107 Machine Learning detection for dropped file 20->107 26 vpn.exe 7 20->26         started        28 6.exe 7 20->28         started        30 4.exe 4 20->30         started        109 Submitted sample is a known malware sample 24->109 111 Obfuscated command line found 24->111 34 conhost.exe 24->34         started        36 timeout.exe 1 24->36         started        signatures10 process11 dnsIp12 38 cmd.exe 1 26->38         started        40 at.exe 1 26->40         started        42 cmd.exe 28->42         started        44 at.exe 1 28->44         started        93 192.168.2.1 unknown unknown 30->93 79 C:\Users\user\AppData\...\SmartClock.exe, PE32 30->79 dropped 46 SmartClock.exe 30->46         started        file13 process14 process15 48 cmd.exe 38->48         started        51 conhost.exe 38->51         started        53 conhost.exe 40->53         started        55 cmd.exe 42->55         started        57 conhost.exe 42->57         started        59 conhost.exe 44->59         started        signatures16 95 Obfuscated command line found 48->95 61 findstr.exe 48->61         started        63 Sua.exe.com 48->63         started        65 findstr.exe 55->65         started        process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76386b4c6c46b36b26d9ce00df7982d461bcd1a7586dde62cd831349d0aa3a4b/
Threat name:
Win32.Trojan.Mokes
Create hunting rule
Status:
Malicious
First seen:
2021-03-29 12:44:13 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oy4gwtdmi2zwwjwzzyan66mc2rq3zunhlbw54ywnqmjutufkhjfq._file
Verdict:
malicious
Similar samples:
10c0f1080840ab3cf7fd69f80a6b821a6f95cb7b57a7e43dfb757e9df598c18a
CryptBot
118f24dab3dce4a5ae6e3ab078551cbc628b475abeeafa07a5972622aaa38812
CryptBot
39a27d15f3d6175331a974825a440d7475187bae0c133a48a1a5155b49a82537
CryptBot
6c219118acdf6e43d54298e2a7c268c0877a4f31c207cd29d2e038a858cea9fe
CryptBot
7bc379fd5f28ca0016ae282820d517d7719cad2742a22968cc3c9d3434ff469d
CryptBot
9cda1177646d0a69217e80541b33a93f1343a3406729fd09fb19a19808cfed4b
CryptBot
b9fe450826cf7e036b06af03cee2288464efff6bc72c4ada9299c38128ee5f77
CryptBot
c8a30abef2939b6c3b6193feffbaf8ba4a87c79fc32e71b10b94bbdb8e1e238f
CryptBot
e784ba83c1139d2d9880a2cd5546d1d7716694452ea84367fa9c238f97d5e5ad
CryptBot
f4e11cd74d31517b59663b1eb83955c4f2dc270143bea943b5b82c5c936fcc01
CryptBot
+ 91 additional samples on MalwareBazaar
Result
Malware family:
cryptbot
Create hunting rule
Score:
  10/10
Tags:
family:cryptbot discovery spyware stealer
Link:
https://tria.ge/reports/210329-2wz8t8vcfj/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies registry class
Modifies system certificate store
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
CryptBot
Unpacked files
SH256 hash:
6500edaebebf2fe874c8ffe2e1fc706ce5e29858fe145c5117aa390bda4008f6
MD5 hash:
c7b05ef7d62ea8fb21fd94bdfa145090
SHA1 hash:
600346218dcaa1a42b3edf719f4110ea1bf06f6a
Link:
https://www.unpac.me/results/710c3384-6998-4822-9ac1-5eb3c43d1ea2/
SH256 hash:
76386b4c6c46b36b26d9ce00df7982d461bcd1a7586dde62cd831349d0aa3a4b
MD5 hash:
c64c77ce0a7548d644d3d79ec798bdf9
SHA1 hash:
e97629c48229194c49ccbf08ac765afaf4740bfa
Link:
https://www.unpac.me/results/710c3384-6998-4822-9ac1-5eb3c43d1ea2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Glupteba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76386b4c6c46b36b26d9ce00df7982d461bcd1a7586dde62cd831349d0aa3a4b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe 76386b4c6c46b36b26d9ce00df7982d461bcd1a7586dde62cd831349d0aa3a4b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1095248/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/127609/

Comments