MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f82fbbe9299d584de960e39098e58f128248827d99aca1cc89f876ef2b30ea0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CryptOne

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	9f82fbbe9299d584de960e39098e58f128248827d99aca1cc89f876ef2b30ea0
SHA3-384 hash:	39aaadc06c4eb26b4b9cfe66f7ac9374aa4812bca9ce8ed453d67341eea4064eb0ffc6b90ae48fb78cd20f96b301918e
SHA1 hash:	d05d47dc085c1518d6364d90c17601801313a226
MD5 hash:	db40c5f442485ca57b322c13350bbd32
humanhash:	alanine-fruit-early-fruit
File name:	db40c5f442485ca57b322c13350bbd32.exe
Download:	download sample
Signature	CryptOne Create hunting rule
File size:	1'491'733 bytes
First seen:	2023-02-11 14:33:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e92b2275a730f59940462780c383a1b0 (26 x CryptOne, 3 x Loki, 2 x Mimic)
ssdeep	24576:YLeTtjJFtHrK8g8utYCUQSoJeV7ojSROV8QMj0ao61ayABfScHS8vjvRI17:YLYk8WtY5ojRaQMjo61E/S8vjqt
Threatray	894 similar samples on MalwareBazaar
TLSH	T190652332B6C184B1D873283A1AF29770AA3DBD2007B1DEDF63643B1D6B615C19937762
TrID	89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.5% (.EXE) Win64 Executable (generic) (10523/12/4) 2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 1.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	abuse_ch
Tags:	CryptOne exe

Intelligence

File Origin

# of uploads :

# of downloads :

212

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

db40c5f442485ca57b322c13350bbd32.exe

Verdict:

Malicious activity

Analysis date:

2023-02-11 14:39:49 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/79dba866-92a6-4ac8-875f-96ec8173d238

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/364031/

Detection(s):

SecuriteInfo.com.Trojan.Uztuby.4.132.18606.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Launching a process

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/68172/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

80%

Tags:

greyware overlay packed setupapi.dll shdocvw.dll shell32.dll

Link:

https://www.filescan.io/uploads/63e7a762fc3c2a54c6f8d22b/reports/13b98f8a-160f-428d-9e90-e4c7df5a9123/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/9f82fbbe9299d584de960e39098e58f128248827d99aca1cc89f876ef2b30ea0

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/acbc020e-2819-4306-a1e1-005bcf94a050

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1172114

Signature

Machine Learning detection for dropped file

Machine Learning detection for sample

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9f82fbbe9299d584de960e39098e58f128248827d99aca1cc89f876ef2b30ea0/

Threat name:

Win32.Trojan.Zenpak

Status:

Malicious

First seen:

2023-02-11 14:34:13 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 39 (41.03%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t6bpxpusthkyjxuwby4qtdsy6eucjcbh3gnmuhgit6dw54vtb2qa._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230211-rxf5safb8s/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

Unpacked files

SH256 hash:

9f82fbbe9299d584de960e39098e58f128248827d99aca1cc89f876ef2b30ea0

MD5 hash:

db40c5f442485ca57b322c13350bbd32

SHA1 hash:

d05d47dc085c1518d6364d90c17601801313a226

Link:

https://www.unpac.me/results/03c70b24-de55-49d9-8340-fef014d87b7f/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9f82fbbe9299d584de960e39098e58f128248827d99aca1cc89f876ef2b30ea0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.