MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b75f742ad569048f45c0898e017dfcc56e1ac7f98c40249a444fc1dad6ebb49c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b75f742ad569048f45c0898e017dfcc56e1ac7f98c40249a444fc1dad6ebb49c
SHA3-384 hash: 962c4dd2c641c6b1ba1e6bdf863b28f77fcb0330b4f7e29b37b2c0774456170c728316bafff3e8e13fe385273242670b
SHA1 hash: ac65098ddbe6694035132914ec2d4a35bf24b7bc
MD5 hash: 30910bccf7b3d9d26cfd4cb6936b83fc
humanhash: maine-sink-east-angel
File name:SecuriteInfo.com.BehavesLike.Win32.Trojan.jc.17923
Download: download sample
Signature CryptBot
Create hunting rule
File size:636'928 bytes
First seen:2021-01-10 21:42:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 19ed1407a3fa8f80d2797cee20c2d37c (2 x CryptBot)
ssdeep 12288:8XgY2SE/mevJ14upYg1CHxyISXV2GXcAdZ+i6GVlnZSmgf4pJ:8dMmex14kYg10xyrXIGjZ+fGBSXf4pJ
Threatray 50 similar samples on MalwareBazaar
TLSH A1D412C1566C2AEEF08D493CD560AE1385B66F020A642EA1FD47CABD7E7F4D1943134E
Reporter SecuriteInfoCom
Tags:CryptBot

Intelligence

File Origin
# of uploads :
1
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.BehavesLike.Win32.Trojan.jc.17923
Verdict:
Malicious activity
Analysis date:
2021-01-10 21:43:09 UTC
Tags:
stealer trojan loader
Link:
https://app.any.run/tasks/0ce24a42-f26d-4d68-99f0-eecfa2bdf8e3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/111183/
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

PUA.Win.Packer.Upx-4
Create hunting rule

SecuriteInfo.com.BehavesLike.Win32.Trojan.jc.17923.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Reading critical registry keys
Delayed reading of the file
Deleting a recently created file
Creating a window
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Creating a file
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
Sending a UDP request
Searching for analyzing tools
Searching for the window
Creating a file in the %AppData% subdirectories
Launching a process
Sending a custom TCP request
Stealing user critical data
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Cryptbot Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/577511
Signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Potentially malicious time measurement code found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Cryptbot
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 337806 Sample: SecuriteInfo.com.BehavesLik... Startdate: 10/01/2021 Architecture: WINDOWS Score: 100 65 Malicious sample detected (through community Yara rule) 2->65 67 Antivirus detection for URL or domain 2->67 69 Antivirus detection for dropped file 2->69 71 13 other signatures 2->71 8 SecuriteInfo.com.BehavesLike.Win32.Trojan.jc.exe 48 2->8         started        13 SmartClock.exe 2->13         started        15 SmartClock.exe 2->15         started        process3 dnsIp4 57 kypersai26.top 95.181.157.160, 49732, 80 MSKHOSTRU Russian Federation 8->57 59 morttttf08.top 45.133.216.136, 49730, 49731, 80 CLOUDSOLUTIONSRU Russian Federation 8->59 61 kypersar42.top 8->61 51 C:\Users\user\AppData\Local\Temp\File35.exe, PE32 8->51 dropped 53 C:\Users\user\AppData\Local\...\lv[1].exe, PE32 8->53 dropped 83 Tries to harvest and steal browser information (history, passwords, etc) 8->83 17 File35.exe 20 8->17         started        20 cmd.exe 1 8->20         started        85 Hides threads from debuggers 13->85 87 Tries to detect sandboxes / dynamic malware analysis system (registry check) 13->87 file5 signatures6 process7 file8 41 C:\Users\user\AppData\Local\...\vpn_ico.exe, PE32 17->41 dropped 43 C:\Users\user\AppData\Local\...\6_ico.exe, PE32 17->43 dropped 45 C:\Users\user\AppData\Local\...\4_ico.exe, PE32 17->45 dropped 47 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 17->47 dropped 22 4_ico.exe 4 17->22         started        26 vpn_ico.exe 3 19 17->26         started        29 6_ico.exe 3 17->29         started        31 conhost.exe 20->31         started        33 timeout.exe 1 20->33         started        process9 dnsIp10 49 C:\Users\user\AppData\...\SmartClock.exe, PE32 22->49 dropped 79 Hides threads from debuggers 22->79 81 Tries to detect sandboxes / dynamic malware analysis system (registry check) 22->81 35 SmartClock.exe 22->35         started        63 ip-api.com 208.95.112.1, 49734, 80 TUT-ASUS United States 26->63 38 wscript.exe 26->38         started        file11 signatures12 process13 dnsIp14 73 Hides threads from debuggers 35->73 75 Tries to detect sandboxes / dynamic malware analysis system (registry check) 35->75 55 iplogger.org 88.99.66.31, 443, 49737 HETZNER-ASDE Germany 38->55 77 System process connects to network (likely due to code injection or exploit) 38->77 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b75f742ad569048f45c0898e017dfcc56e1ac7f98c40249a444fc1dad6ebb49c/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-01-10 20:15:53 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w5pxikwvneci6roarghac7p4yvxbvr7zrracjgsej7a5vvxlwsoa._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
07cf6baf41520d0e97f2010bf76c2ed10509fbf599209ae4bc250eb375515114
CryptBot
1a3e09c9e55edd4048813fe5a20a87e840cb96039f199a0f6f960f315a61486f
CryptBot
37cb831726dc1877ea59cf5618e4fa224368bbd64a7047dec6fb554a6a17d4c2
CryptBot
57e0906e3b6e13fe8db13cc06ce37d957bfc045afa6e99e9cf8b893ceb57d018
CryptBot
7c3c41d8da242f6ae707daaf842c0c0afb4ff541e3b009c62e51bc7d93eca86b
CryptBot
9c8d27a664a59f47820584b9e49196cdbf34b285b567cb8b63ce0794f271e863
CryptBot
ada1c5359c35e6b70c5a2d5533f9d725f86a1e155c8486bfd2941c9b40478ea2
CryptBot
b0c5153cf37bc26d5845c41dd969822cfc272186c49f0b447060259787bf024a
CryptBot
b9c037384eaa82706baf7c3cd5e1550fe9ad24083edeb00e55d9da8198ea6ee3
CryptBot
f5f817441e672588eb3404816c3afc7adf4a74636414bc897ab818aaf2a71786
CryptBot
+ 40 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
discovery evasion spyware upx
Link:
https://tria.ge/reports/210110-yz63csnt56/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Drops desktop.ini file(s)
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Deletes itself
Drops startup file
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Blocklisted process makes network request
Executes dropped EXE
UPX packed file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
b75f742ad569048f45c0898e017dfcc56e1ac7f98c40249a444fc1dad6ebb49c
MD5 hash:
30910bccf7b3d9d26cfd4cb6936b83fc
SHA1 hash:
ac65098ddbe6694035132914ec2d4a35bf24b7bc
Link:
https://www.unpac.me/results/1e29f9b4-d647-47dd-b4a8-1a25de49ba4d/
SH256 hash:
1b0101a63c1d0bb6ef0659106adefedec21efc319b3d58f1077c009fe5c2a997
MD5 hash:
2a91c9237ce3b3a3e9643b66e6c6f8a1
SHA1 hash:
6f6a4a9ff7dcfc194803b93c28d0fa0d8dbcb7da
Link:
https://www.unpac.me/results/1e29f9b4-d647-47dd-b4a8-1a25de49ba4d/
SH256 hash:
1ea74db3d011f92dc12595e978602dcff396ae265e4ab51dd261b7f73d97ce2d
MD5 hash:
05ca28004b6be5d6e14e59c7a591224c
SHA1 hash:
25914dccdb3bb9d6ce589ec525a4804231a13747
Detections:
win_cryptbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/1e29f9b4-d647-47dd-b4a8-1a25de49ba4d/
Parent samples :
723cd9a121f4dbdd70fba3a061d63921ac8c7a20723f9eec00e7664e4b0ce454
1a3e09c9e55edd4048813fe5a20a87e840cb96039f199a0f6f960f315a61486f
b75f742ad569048f45c0898e017dfcc56e1ac7f98c40249a444fc1dad6ebb49c
ffb27074c9ab066faecbaa1ad2e2824ba16553f0cf56fc658e62bc137db50c63
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b75f742ad569048f45c0898e017dfcc56e1ac7f98c40249a444fc1dad6ebb49c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe b75f742ad569048f45c0898e017dfcc56e1ac7f98c40249a444fc1dad6ebb49c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/951747/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/111183/

Comments