MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fee491edf91da322784a560a7f4544226dd9f29cdaf5f6d09040dd06fd6a1a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CryptBot

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	8fee491edf91da322784a560a7f4544226dd9f29cdaf5f6d09040dd06fd6a1a0
SHA3-384 hash:	7c0e35ca9d6f0a10c205866a4e70fee5aafd147241b15f030f8b7735c8efa57c51d1958728d9095aa74a6fa435558a31
SHA1 hash:	afb9a97461ceb5bbf04400bf85c973c611a5b01d
MD5 hash:	755ebe42ffa07fe0a24f21681a314d44
humanhash:	mockingbird-cat-butter-item
File name:	p3.exe
Download:	download sample
Signature	CryptBot Create hunting rule
File size:	868'464 bytes
First seen:	2021-11-18 16:31:19 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c34e11db92473175947624b5e890b7ef (1 x CryptBot)
ssdeep	12288:oYkqd9JDBkQncz0CD6e98RdT2/xCBaWFc59NLVislUfM1B0MfDQJBF:yq9B3A0+6hRF25CaZDfrQJr
Threatray	13 similar samples on MalwareBazaar
TLSH	T1F0054BE0F82AAF57E277C57C9C18B6DCDAE414B2DE03D0BA7095EDA054B2380D519B2D
Reporter	0091_sec
Tags:	CryptBot exe keylogger

Intelligence

File Origin

# of uploads :

# of downloads :

221

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

p3.exe

Verdict:

Malicious activity

Analysis date:

2021-11-18 16:23:50 UTC

Tags:

stealer trojan loader

Link:

https://app.any.run/tasks/b3270317-147f-4ffa-b126-f5ef3c645e8a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

CryptBot

Link:

https://www.capesandbox.com/analysis/207310/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.19431.19672.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% subdirectories

Creating a window

DNS request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

keylogger overlay packed

Link:

https://www.filescan.io/uploads/619680022695a62af9f3226b/reports/0d6cc86d-57e5-4b52-bcc9-9e8799ae691a/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/859cb773-70c8-44ea-bd2a-c1a5bb0514a2

Result

Threat name:

Cryptbot

Detection:

malicious

Classification:

troj.spyw

Score:

84 / 100

Link:

https://www.joesandbox.com/analysis/892098

Signature

C2 URLs / IPs found in malware configuration

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Cryptbot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8fee491edf91da322784a560a7f4544226dd9f29cdaf5f6d09040dd06fd6a1a0/

Threat name:

Win32.Trojan.GenSteal

Status:

Malicious

First seen:

2021-11-18 15:48:28 UTC

AV detection:

13 of 28 (46.43%)

Threat level:

5/5

Verdict:

malicious

CryptBot

59193209add2aa657db4343d23ddc12453746a3cdf63117db522f3976bd88cc0

CryptBot

6319b895e7a61947bfa702bf9f092d585f76a983666bbceb8d6dcbabe50e330d

CryptBot

6f4ac0da343abb9dd25d7a27c302a6ab29ed9e7c49123b3c8200138abd3eaea5

CryptBot

879fccdf9b4b09063a6dbf1ac2cc381a1ebcacf6e38f5b8d4889785a4ccde22a

CryptBot

bf45b415add34c4a9cfd28e2f0060a5771b452a290d4807cc66e5e0355b014c0

CryptBot

f1e81f8fc03025e450dc6d59f86acd9cb55942d3bc94f82c28274e08fc2074f8

CryptBot

+ 3 additional samples on MalwareBazaar

Result

Malware family:

cryptbot

Score:

10/10

Tags:

family:cryptbot discovery spyware stealer

Link:

https://tria.ge/reports/211118-t1ykcahfh7/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Windows directory

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Deletes itself

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

CryptBot

Malware Config

C2 Extraction:

cipkzp43.top
morzoj04.top

Unpacked files

SH256 hash:

fca8e89321a572fdba7e76528779bddcececd757464688e8236077b0a8031490

MD5 hash:

c88ce8a0296b3aa07216032b084c9c7a

SHA1 hash:

e694f154957c689740b7a0ef6a742e2cf2e63f28

Link:

https://www.unpac.me/results/147b3adc-56be-4a63-84b4-c23694f2107e/

SH256 hash:

8fee491edf91da322784a560a7f4544226dd9f29cdaf5f6d09040dd06fd6a1a0

MD5 hash:

755ebe42ffa07fe0a24f21681a314d44

SHA1 hash:

afb9a97461ceb5bbf04400bf85c973c611a5b01d

Link:

https://www.unpac.me/results/147b3adc-56be-4a63-84b4-c23694f2107e/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/8fee491edf91/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8fee491edf91da322784a560a7f4544226dd9f29cdaf5f6d09040dd06fd6a1a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	INDICATOR_KB_CERT_1f3216f428f850be2c66caa056f6d821 Create hunting rule
Author:	ditekSHen
Description:	Detects executables signed with stolen, revoked or invalid certificates