MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a6c916427ad4b4693f276085914313efc50a9b2716428bb644a35df82461126. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptOne


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a6c916427ad4b4693f276085914313efc50a9b2716428bb644a35df82461126
SHA3-384 hash: 4b2d5c469cfdfe047689ef2bb6796a205c8004bae5aed647b5285932448eb010808be1b6cd40ba8a95d353f6b080de60
SHA1 hash: d006ddc89f852317cac83f411cdf27cfc2b73438
MD5 hash: 0cdcd04be6f9c4eab43ae442d6551e59
humanhash: indigo-high-delaware-earth
File name:0cdcd04be6f9c4eab43ae442d6551e59.exe
Download: download sample
Signature CryptOne
Create hunting rule
File size:1'869'999 bytes
First seen:2022-11-07 11:34:13 UTC
Last seen:2022-11-07 13:27:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:F0BfJXAEh4u80FazmJcmZqX7VZhdGDWN9d3aAHA:F0BfKEh4oJJZqXhF9qB
Threatray 2'460 similar samples on MalwareBazaar
TLSH T106852302B68288B2D1721E35893AE756997CBC701F24DB0EF7D4287E9EB41819335F67
TrID 88.3% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
4.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.0% (.EXE) Win32 Executable (generic) (4505/5/1)
0.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon b3b3b371716b93b3 (25 x CryptOne, 12 x RemcosRAT, 6 x RedLineStealer)
Reporter abuse_ch
Tags:CryptOne exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
0cdcd04be6f9c4eab43ae442d6551e59.exe
Verdict:
Malicious activity
Analysis date:
2022-11-07 11:42:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1426c7e3-e9bc-429a-a43b-2674cc441408

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/329864/
Detection(s):
SecuriteInfo.com.Trojan.Uztuby.4.6967.4389.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Uztuby.4.29290.7140.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/49572/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/6368ed69775605b3a4f3db78/reports/f96e08fe-bf3c-4a9e-bd3b-af74afddf231/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e3ee61b8-6de2-41a1-9696-dc165f84468a
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1107207
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to detect sleep reduction / modifications
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 739890 Sample: ToZ5MMLSlZ.exe Startdate: 07/11/2022 Architecture: WINDOWS Score: 92 23 Antivirus detection for dropped file 2->23 25 Antivirus / Scanner detection for submitted sample 2->25 27 Multi AV Scanner detection for dropped file 2->27 29 4 other signatures 2->29 9 ToZ5MMLSlZ.exe 3 8 2->9         started        process3 file4 21 C:\Users\user\AppData\Local\Temp\~92JFZ.cpl, PE32 9->21 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        signatures7 31 Contains functionality to detect sleep reduction / modifications 14->31 17 rundll32.exe 14->17         started        process8 process9 19 rundll32.exe 17->19         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a6c916427ad4b4693f276085914313efc50a9b2716428bb644a35df82461126/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-11-07 07:34:05 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
21 of 25 (84.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pjwjczbhvvfune7soyefsfbrh36fbknsofscro3eji257asgceta._file
Verdict:
malicious
Similar samples:
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
CryptOne
4618fb57958c19496e668916d769cb40e6bb0a0af0fbb1ff73ee89e701f3fe9b
CryptOne
4e469250720f93f967063cdda420d7bb6ab8ca9c199368ea284c6dd2144c5243
CryptOne
aa005608adb8e7e3c775383f20f2608164056713bcbb92d0ec5c99994d8af750
CryptOne
af64f5b2b6c4cc63b0ca4bb48f369eba1629886d85e289a469a5c9612c4a5ee3
CryptOne
b1f692dd52aae8317db7cfd262a4bcc053cf721fc7a00bf66f4acc7cb5cc6cbc
CryptOne
b2a324897aebabb250e405cf19388be6979b40615b16b7b7d816c44ca90ec3fe
CryptOne
d15e506977055556f490656e5abddb4c774ed22f58d7fa6ec6523e0148911408
CryptOne
df59ccb9d70f7f61dc2c65faa61446278fb402b64401f2f3cfe8bbad72f70610
CryptOne
+ 2'450 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221107-np187sgbgl/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/3d04a70c-0079-40f9-9dcd-16b158fb2bef
Unpacked files
SH256 hash:
bc0c22d2146f1d264a7eb74c1350652203dc83006d0f7399bc13c7baa0628edf
MD5 hash:
3f443e312d760a9acab10caffb36ac68
SHA1 hash:
ed722c53703b19772f386054633323e7dcc358b8
Link:
https://www.unpac.me/results/af7af2b5-61ee-4acc-b4e1-b67083279dff/
SH256 hash:
2b1708d3ad7721f055b39359c33cbf4ab288ffd395459acd0402be178e566a99
MD5 hash:
29ecadb9eeed2b21056042de1c8d2454
SHA1 hash:
721d3a737cd8399488d38f48a8cfddbeb8dd975c
Link:
https://www.unpac.me/results/af7af2b5-61ee-4acc-b4e1-b67083279dff/
SH256 hash:
7a6c916427ad4b4693f276085914313efc50a9b2716428bb644a35df82461126
MD5 hash:
0cdcd04be6f9c4eab43ae442d6551e59
SHA1 hash:
d006ddc89f852317cac83f411cdf27cfc2b73438
Link:
https://www.unpac.me/results/af7af2b5-61ee-4acc-b4e1-b67083279dff/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7a6c916427ad4b4693f276085914313efc50a9b2716428bb644a35df82461126

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptOne

Executable exe 7a6c916427ad4b4693f276085914313efc50a9b2716428bb644a35df82461126

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/329864/
  
URLhaus
https://urlhaus.abuse.ch/url/2401723/
  
Delivery method
Distributed via web download

Comments