MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 abf577d630967397cee186f4f68c175de87c377ff35719cd42c213a258148f88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CryptOne

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	abf577d630967397cee186f4f68c175de87c377ff35719cd42c213a258148f88
SHA3-384 hash:	b9d5e3e049ea9b27ba99b556eb2f48e1da34bf30d0f28a4c5994be6e53c316a85af2403c46b77d16e1cd50a11fa40351
SHA1 hash:	8cf64e7fc411f460543e041687db4d2151fe6e4c
MD5 hash:	69af4e67b8756a06a2c06c9b095089a2
humanhash:	rugby-july-paris-lion
File name:	69af4e67b8756a06a2c06c9b095089a2.exe
Download:	download sample
Signature	CryptOne Create hunting rule
File size:	1'458'194 bytes
First seen:	2023-02-16 08:41:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	91e96141ed5dbe3bc541c8aad7ff3c38 (22 x CryptOne, 7 x njrat, 5 x DCRat)
ssdeep	24576:JLllLl7tEtlkWcGEAolOwSAzyCWyYuccnLv3ckSgFpv4pvz1qLA:hllL8lkWxB6OwlyCWyz/Sk8z1qLA
Threatray	541 similar samples on MalwareBazaar
TLSH	T15465121576C0C471D8A719310AF197B26BBDBC305B35CAE747542B2E8B704E2DA36BA3
TrID	91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	abuse_ch
Tags:	CryptOne exe

Intelligence

File Origin

# of uploads :

# of downloads :

228

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

69af4e67b8756a06a2c06c9b095089a2.exe

Verdict:

Malicious activity

Analysis date:

2023-02-16 08:45:36 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9898014e-22dd-41de-af40-5d3263f0bc26

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/367119/

Detection(s):

SecuriteInfo.com.Variant.Fugrafa.267521.30514.22927.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Launching a process

Sending a custom TCP request

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/70796/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

80%

Tags:

greyware overlay packed setupapi.dll shdocvw.dll shell32.dll

Link:

https://www.filescan.io/uploads/63edec5c108162e31cca6e07/reports/3bf00943-aad8-4bd1-9db2-5f9eb6df02e3/overview

Verdict:

Malicious

Labled as:

Fugrafa.Generic

Link:

https://www.hybrid-analysis.com/sample/abf577d630967397cee186f4f68c175de87c377ff35719cd42c213a258148f88

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Emotet

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/86d3f104-569c-423a-a777-0b1b945f253b

Result

Threat name:

CryptOne

Detection:

malicious

Classification:

troj.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1176733

Signature

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Machine Learning detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected CryptOne packer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/abf577d630967397cee186f4f68c175de87c377ff35719cd42c213a258148f88/

Threat name:

Win32.Trojan.Fugrafa

Status:

Malicious

First seen:

2023-02-16 08:42:09 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 24 (87.50%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vp2xpvrqszzzptxbq32pndaxlxuhyn376nlrttkcyij2ewaur6ea._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230216-kl25jsgd9t/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

Unpacked files

SH256 hash:

abf577d630967397cee186f4f68c175de87c377ff35719cd42c213a258148f88

MD5 hash:

69af4e67b8756a06a2c06c9b095089a2

SHA1 hash:

8cf64e7fc411f460543e041687db4d2151fe6e4c

Link:

https://www.unpac.me/results/aa173db0-5e8f-4080-91e8-bdf58b5921d7/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/abf577d630967397cee186f4f68c175de87c377ff35719cd42c213a258148f88

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.