MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8bd89781eaebac4530248445e3e08a075853b1a798ed99b8df575980a2eab909. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8bd89781eaebac4530248445e3e08a075853b1a798ed99b8df575980a2eab909
SHA3-384 hash:	2308d385323bcf3778d470bd9cf8a9b52982d3d1e2d23b34516dadd7fe41d2d967dc0b713e265c0d526f33edfe74ffac
SHA1 hash:	dac30f0bab9af35ad47310e2b9f55eed0882282f
MD5 hash:	8359a0860da9bdb2aea67e0d5d78e02a
humanhash:	pasta-hawaii-floor-oven
File name:	8359a0860da9bdb2aea67e0d5d78e02a.exe
Download:	download sample
Signature	CryptOne Alert Create hunting rule
File size:	1'832'161 bytes
First seen:	2023-07-04 07:26:13 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	aac51396886833dc961fcd7aab7711e4 (11 x NetSupport, 7 x DCRat, 4 x njrat)
ssdeep	24576:8HHyFCEEQFmSNhUVZXKhmcMRzctO6+7ZeURfF5fWfRqsekUMMJXvB3LLXu/ZhIlL:zeZalFOTP95URzePJ57+vIlzf
Threatray	3 similar samples on MalwareBazaar
TLSH	T139852302BAC4C5B1D432293356759F11B93C7C612B768EDF63902A9EDF225D06A32F36
TrID	91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	abuse_ch
Tags:	CryptOne exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

294

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

8359a0860da9bdb2aea67e0d5d78e02a.exe

Verdict:

Malicious activity

Analysis date:

2023-07-04 07:29:10 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/58d3c041-e973-478d-980a-1bb5a028fcc4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/406294/

ClamAV Detected

Detection(s):

Win.Malware.Uztuby-9979905-0

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Launching a process

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/95479/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-vm greyware lolbin overlay packed packed regsvr32 regsvr32 replace setupapi shdocvw shell32

Link:

https://www.filescan.io/uploads/64a3c9c62299d26882649a0a/reports/717bf990-99e3-4c19-98a8-bb16e8423281/overview

Hybrid Analysis Trojan.Uztuby

Verdict:

Malicious

Labled as:

Trojan.Uztuby

Link:

https://www.hybrid-analysis.com/sample/8bd89781eaebac4530248445e3e08a075853b1a798ed99b8df575980a2eab909

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fbb8d87c-b343-42d6-8f25-7efc8c34fba8

Joe Sandbox CryptOne

Result

Threat name:

CryptOne

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1266423

Signature

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Yara detected CryptOne packer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8bd89781eaebac4530248445e3e08a075853b1a798ed99b8df575980a2eab909/

ReversingLabs TitaniumCloud Win32.Trojan.Fauppod

Threat name:

Win32.Trojan.Fauppod

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-04 07:27:06 UTC

File Type:

PE (Exe)

Extracted files:

18

AV detection:

18 of 24 (75.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rpmjpapk5owekmbeqrc6hyeka5mfhmnhtdwztog7k5mybixkxeeq._file

Threatray malicious

Verdict:

malicious

Similar samples:

38e48e1967243e151457e75a0b17b04d65a840308d68cf116da52c2fa944f330

CryptOne

43d1c7d70506db33b4db5a3f27582e1f1493b69b6d2493756c88f550529ca969

CryptOne

811566c02b85bfff2c60105b3638aa7a7d906658c1fc1fd0e2f5112dfcb492be

CryptOne

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230704-h931msbe48/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

165eedf084482606cebb6f9f3343738bcdd94fba1b8509e47372c40745e2bd40

MD5 hash:

2b7cf9670c192c0cd01ee99e8a7a5354

SHA1 hash:

c74f9ceccfa8d1a6847f02f87bcb5764e6fdfde5

Link:

https://www.unpac.me/results/3964bdaa-c17b-41b3-9faf-c4c6669c5358/

SH256 hash:

8bd89781eaebac4530248445e3e08a075853b1a798ed99b8df575980a2eab909

MD5 hash:

8359a0860da9bdb2aea67e0d5d78e02a

SHA1 hash:

dac30f0bab9af35ad47310e2b9f55eed0882282f

Link:

https://www.unpac.me/results/3964bdaa-c17b-41b3-9faf-c4c6669c5358/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptOne

exe 8bd89781eaebac4530248445e3e08a075853b1a798ed99b8df575980a2eab909

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2675870/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/406294/