MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a12e61120c29498cb7e61c9074a5c854672a71a76b968cdd9db9e17496d20e42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a12e61120c29498cb7e61c9074a5c854672a71a76b968cdd9db9e17496d20e42
SHA3-384 hash: d9e60988bf3cb6a1424597a944ee35c062538a554a41ef2996b214a68a9b7b7f806ecfe473806073a54e47beec354d63
SHA1 hash: d201858e7f11f4e180ee72237a82fa260c8f4ed4
MD5 hash: 7fbc4f164d80315d26d5d663b7a64cd6
humanhash: burger-mockingbird-earth-river
File name:7fbc4f164d80315d26d5d663b7a64cd6.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:729'600 bytes
First seen:2021-04-15 17:15:38 UTC
Last seen:2021-04-15 18:04:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c3800c56dd787c3bbf0c039fc8079bf1 (2 x CryptBot)
ssdeep 12288:Tq9CTZg7+/DvS7+KJBv2tCV3/UUI88f7gZ8nN+Afhjg+s8yCXqYA3p:+UZuafaBvHV3/fCEZidjgXgXqZ
Threatray 47 similar samples on MalwareBazaar
TLSH 94F4010072D1C0B3E45778B68425CBB14EBA74751B2A5ACFABD90FBC5F286C1963634E
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7fbc4f164d80315d26d5d663b7a64cd6.exe
Verdict:
Malicious activity
Analysis date:
2021-04-15 17:57:43 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/8c3e8a5e-4eb6-4f7e-bfa2-f6fbb5bd1671

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/135312/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.46096489.23947.29968.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Sending a custom TCP request
Deleting a recently created file
Creating a file
Delayed reading of the file
Reading critical registry keys
Creating a window
DNS request
Sending a UDP request
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/679122
Signature
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a12e61120c29498cb7e61c9074a5c854672a71a76b968cdd9db9e17496d20e42/
Threat name:
Win32.Trojan.Ranumbot
Create hunting rule
Status:
Malicious
First seen:
2021-04-14 13:47:51 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uexgceqmffeyzn7gdsihjjoikrtsu4nhnolizxm5xhqxjfwsbzba._file
Verdict:
unknown
Similar samples:
596ab1ddff660a3cd00e14f5e43d5af6a0ad03a41d07a51344b8eb61a594d27f
CryptBot
5ff8c7ade325a6a34543acf75e21e91387eaee3c0f264f5ab98b657cafdfa30b
CryptBot
7c902b5da243bec90b83e4d68e4e8c097d1e36e9d9508c5095023f801440d977
CryptBot
884837b998040b03adc5dead61073ad9314ef82754ae0cb415e685297f25a776
CryptBot
8f4429f86954c0f69125d0b5aa2336b24056e75514390c7f8450d97fba84a584
CryptBot
941d3312f126a5104966af87ce58d9be63bbaf63216723508d9dd2d2f241fea7
CryptBot
b9fe450826cf7e036b06af03cee2288464efff6bc72c4ada9299c38128ee5f77
CryptBot
bcc495c75df0a47f59a60fdfb870bf833f0d320aff3f1e316f1cd96b5e578c07
CryptBot
bced04a0ef9306f81abe9dcd2bf613802076f1d2012f23bcc42a208acabf25dd
CryptBot
e15820902d036f76c33cd6e8b2efdf4aed6e43a434680320aa7aba1ffca2ec17
CryptBot
+ 37 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/210415-dwld6fq4j6/
Behaviour
Checks processor information in registry
Suspicious use of FindShellTrayWindow
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
9c9255f2329ea7ea9b91e0c0e2d21019b4499202b430be0b1406b93dbd317149
MD5 hash:
f7f08f6b9381f919f1774358adc32826
SHA1 hash:
3bd13f5851ca1929eb72c2b9c1650e5975960b84
Link:
https://www.unpac.me/results/7b910eb3-d14f-4d70-905c-ebcb0620d4fb/
SH256 hash:
a12e61120c29498cb7e61c9074a5c854672a71a76b968cdd9db9e17496d20e42
MD5 hash:
7fbc4f164d80315d26d5d663b7a64cd6
SHA1 hash:
d201858e7f11f4e180ee72237a82fa260c8f4ed4
Link:
https://www.unpac.me/results/7b910eb3-d14f-4d70-905c-ebcb0620d4fb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a12e61120c29498cb7e61c9074a5c854672a71a76b968cdd9db9e17496d20e42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe a12e61120c29498cb7e61c9074a5c854672a71a76b968cdd9db9e17496d20e42

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1107223/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/135312/

Comments