MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bea445cd71f0615353625114161291b7b9cab80829b3670951252053c72e68d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptOne


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bea445cd71f0615353625114161291b7b9cab80829b3670951252053c72e68d4
SHA3-384 hash: 0a2e89d2889d6d67f43707ceababad9af61f82ce114547b3ee3b34d47beb06237866bed6e3d9526f24e2bfe282bdc2b6
SHA1 hash: 0478146969d0ba923c48d7739432e405c0eec92a
MD5 hash: 74785d4d9e9f5acde8351e76b9826f6c
humanhash: carolina-green-earth-gee
File name:74785d4d9e9f5acde8351e76b9826f6c.exe
Download: download sample
Signature CryptOne
Create hunting rule
File size:2'064'359 bytes
First seen:2022-11-07 11:34:38 UTC
Last seen:2022-11-07 13:27:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:F0BfJXAEh4mpR+4mCyIfjhpWGGcz/l2m78ttosqaT91Tm9zZLktJlwOwxyxK:F0BfKEh/+QvFpLBDld8ttosqahBIQ7q1
Threatray 2'460 similar samples on MalwareBazaar
TLSH T14BA52302B695C8B1D6B20E350739AF20647CBC601F61DB5FF7E40E6E9D354826A35BA3
TrID 88.3% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
4.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.0% (.EXE) Win32 Executable (generic) (4505/5/1)
0.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon b3b3b371716b93b3 (25 x CryptOne, 12 x RemcosRAT, 6 x RedLineStealer)
Reporter abuse_ch
Tags:CryptOne exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
155
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
74785d4d9e9f5acde8351e76b9826f6c.exe
Verdict:
Malicious activity
Analysis date:
2022-11-07 11:39:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/39bfeb9e-e248-433e-b7e5-604908dea1f3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/329868/
Detection(s):
SecuriteInfo.com.Trojan.Uztuby.4.29290.7140.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/49575/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/6368ed6e775605b3a4f3db7a/reports/3a6663f1-d4be-42a4-b8de-7ad7692778e7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e3eac367-5273-455e-aa08-a88909f0dcc0
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1107187
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to detect sleep reduction / modifications
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 739851 Sample: p92MTHALlm.exe Startdate: 07/11/2022 Architecture: WINDOWS Score: 92 26 Antivirus detection for dropped file 2->26 28 Antivirus / Scanner detection for submitted sample 2->28 30 Multi AV Scanner detection for dropped file 2->30 32 4 other signatures 2->32 9 p92MTHALlm.exe 3 8 2->9         started        process3 file4 22 C:\Users\user\AppData\Local\...\YZNQBqTr.cpl, PE32 9->22 dropped 12 control.exe 1 9->12         started        process5 dnsIp6 24 192.168.2.1 unknown unknown 12->24 15 rundll32.exe 12->15         started        process7 signatures8 34 Contains functionality to detect sleep reduction / modifications 15->34 18 rundll32.exe 15->18         started        process9 process10 20 rundll32.exe 18->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bea445cd71f0615353625114161291b7b9cab80829b3670951252053c72e68d4/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-11-07 06:29:27 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
26 of 42 (61.90%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x2seltlr6bqvgu3ckekbmeurw644voaifgzwockreuqfhrzondka._file
Verdict:
malicious
Similar samples:
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
CryptOne
4618fb57958c19496e668916d769cb40e6bb0a0af0fbb1ff73ee89e701f3fe9b
CryptOne
4e469250720f93f967063cdda420d7bb6ab8ca9c199368ea284c6dd2144c5243
CryptOne
7a6c916427ad4b4693f276085914313efc50a9b2716428bb644a35df82461126
CryptOne
af64f5b2b6c4cc63b0ca4bb48f369eba1629886d85e289a469a5c9612c4a5ee3
CryptOne
b1f692dd52aae8317db7cfd262a4bcc053cf721fc7a00bf66f4acc7cb5cc6cbc
CryptOne
b2a324897aebabb250e405cf19388be6979b40615b16b7b7d816c44ca90ec3fe
CryptOne
d15e506977055556f490656e5abddb4c774ed22f58d7fa6ec6523e0148911408
CryptOne
df59ccb9d70f7f61dc2c65faa61446278fb402b64401f2f3cfe8bbad72f70610
CryptOne
+ 2'450 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221107-np2jzadgh4/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8f724770-c4c7-49cf-97a7-2692765bd914
Unpacked files
SH256 hash:
bc0c22d2146f1d264a7eb74c1350652203dc83006d0f7399bc13c7baa0628edf
MD5 hash:
3f443e312d760a9acab10caffb36ac68
SHA1 hash:
ed722c53703b19772f386054633323e7dcc358b8
Link:
https://www.unpac.me/results/47530090-f4f6-4d7e-8ebd-367751331565/
SH256 hash:
542dccafa7947b014ed90657fca8bf214298530e4017d46b570a87931d1fffb9
MD5 hash:
d3acbae0d1e2302354dadc4e542fef01
SHA1 hash:
b0cb8784c02233b1caaedeeaf4307cb74f6ed7aa
Link:
https://www.unpac.me/results/47530090-f4f6-4d7e-8ebd-367751331565/
SH256 hash:
bea445cd71f0615353625114161291b7b9cab80829b3670951252053c72e68d4
MD5 hash:
74785d4d9e9f5acde8351e76b9826f6c
SHA1 hash:
0478146969d0ba923c48d7739432e405c0eec92a
Link:
https://www.unpac.me/results/47530090-f4f6-4d7e-8ebd-367751331565/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/bea445cd71f0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bea445cd71f0615353625114161291b7b9cab80829b3670951252053c72e68d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptOne

Executable exe bea445cd71f0615353625114161291b7b9cab80829b3670951252053c72e68d4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2401723/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/329868/

Comments