MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf45b415add34c4a9cfd28e2f0060a5771b452a290d4807cc66e5e0355b014c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf45b415add34c4a9cfd28e2f0060a5771b452a290d4807cc66e5e0355b014c0
SHA3-384 hash: a50280d5686087c1027ff3df23817c4e780878d0b30e36b01bb54bc4a148cb287cc09372dd6cf9cd0f321080ea725bfe
SHA1 hash: 53fe05a28f11fe48c60fd0d2c3dfdba6f7597a87
MD5 hash: 8b9bce00bcd650b996c0d67d57675de7
humanhash: cat-ack-mississippi-shade
File name:8b9bce00bcd650b996c0d67d57675de7
Download: download sample
Signature CryptBot
Create hunting rule
File size:2'577'008 bytes
First seen:2021-11-12 21:51:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash df4d137aff165851ceb794e4a2cb36f2 (1 x CryptBot)
ssdeep 12288:KX35aOpOy0Pby7F5gjpsIpfWFsiWtYR03l/3pD2Q3RN9CjWglBe4dUKELgmLF:KhIDpWKtYSP5r9CqglBeYK
Threatray 326 similar samples on MalwareBazaar
TLSH T131C56B53BF49A422C247FD75B0384B721FA1EE1598AAD71316E1B958DEFA0E0CC51CE2
File icon (PE):PE icon
dhash icon b4f6786a68fca4a0 (1 x CryptBot)
Reporter zbetcheckin
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/205377/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38011632.27948.5434.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/618ee20a3edf00a722d0eeeb/reports/76302b70-9364-45e5-ae94-6b38bb1c19c7/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CryptBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/05a60bee-0cad-48a0-93ee-7baf73680b58
Result
Threat name:
Cryptbot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/888411
Signature
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Self deletion via cmd delete
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Cryptbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 520884 Sample: dBQl7H4Dya Startdate: 12/11/2021 Architecture: WINDOWS Score: 100 67 Found malware configuration 2->67 69 Multi AV Scanner detection for dropped file 2->69 71 Multi AV Scanner detection for submitted file 2->71 73 8 other signatures 2->73 8 dBQl7H4Dya.exe 46 2->8         started        13 DpEditor.exe 2->13         started        process3 dnsIp4 55 xetdyf17.top 92.38.189.206, 49824, 49828, 80 GCOREAT Austria 8->55 57 morgov05.top 5.230.71.73, 49817, 80 ASGHOSTNETDE Germany 8->57 59 lekyvu52.top 212.193.51.40, 49804, 80 ASBAXETNRU Russian Federation 8->59 41 C:\Users\user\AppData\Local\Temp\File.exe, PE32 8->41 dropped 43 C:\Users\user\AppData\Local\...\kubera[1].exe, PE32 8->43 dropped 87 Self deletion via cmd delete 8->87 89 Tries to harvest and steal browser information (history, passwords, etc) 8->89 15 File.exe 25 8->15         started        18 cmd.exe 1 8->18         started        file5 signatures6 process7 file8 45 C:\Users\user\AppData\Local\...\orihonvp.exe, PE32 15->45 dropped 47 C:\Users\user\AppData\Local\...\nasial.exe, MS-DOS 15->47 dropped 49 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 15->49 dropped 51 3 other files (none is malicious) 15->51 dropped 20 orihonvp.exe 3 18 15->20         started        25 nasial.exe 7 15->25         started        27 conhost.exe 18->27         started        29 timeout.exe 1 18->29         started        process9 dnsIp10 53 ip-api.com 208.95.112.1, 49838, 80 TUT-ASUS United States 20->53 37 C:\Users\user\AppData\Local\...\mugpltjea.vbs, ASCII 20->37 dropped 75 Antivirus detection for dropped file 20->75 77 Query firmware table information (likely to detect VMs) 20->77 79 May check the online IP address of the machine 20->79 85 3 other signatures 20->85 31 wscript.exe 12 20->31         started        39 C:\Users\user\AppData\...\DpEditor.exe, MS-DOS 25->39 dropped 81 Multi AV Scanner detection for dropped file 25->81 83 Machine Learning detection for dropped file 25->83 35 DpEditor.exe 1 2 25->35         started        file11 signatures12 process13 dnsIp14 61 iplogger.org 88.99.66.31, 443, 49839 HETZNER-ASDE Germany 31->61 63 System process connects to network (likely due to code injection or exploit) 31->63 65 May check the online IP address of the machine 31->65 signatures15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf45b415add34c4a9cfd28e2f0060a5771b452a290d4807cc66e5e0355b014c0/
Threat name:
Win32.Spyware.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-11-12 17:49:07 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x5c3ifnn2ngevhh5fdrpabqkk5y3iuvcsdkia7ggnzpagvnqctaa._file
Verdict:
malicious
Similar samples:
28f5fa7118d4f1866643d781c3fee5cb4507f3d268c263ef40551d527da2c330
CryptBot
32c6d9d772bf954b06f37b26d1b431aae37d1ff160747cce69d165db62643d49
CryptBot
3afb94af10e2fae81d10a10c089362e6eac18d1a84a2c24c5fb6003e402931a7
CryptBot
6dbc5053ef73f361771e017473f9d53b9df951cc9e0f1d31e1218033160f2b5a
CryptBot
aa88fc6977bf02c959ffa6865b99eeee8c1735001f824d1bbcc4ff01d93fbb74
CryptBot
ad57b2094e9d2cbc75ba695c4400d23a8c24046e08eac6906d6f973a4ffaefb9
CryptBot
b0884a21366325f9e9242b357e7f3d5acf63b7b38e02988e1c1f3454230b5877
CryptBot
e366497c19208fe45bd04dd3d83f4ec71108b2cefeb4fdaeb60e139743c8bb40
CryptBot
e917d16aa3c2d421903d598a6c993da5e76ea3e393e460af5c8d6388a3c3c95f
CryptBot
+ 316 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:cryptbot family:danabot banker discovery evasion spyware stealer themida trojan
Link:
https://tria.ge/reports/211112-1q3vmsecd3/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
CryptBot
Danabot
Malware Config
C2 Extraction:
lekyvu52.top
morgov05.top
192.119.110.73:443
192.236.147.206:443
192.236.192.201:443
Unpacked files
SH256 hash:
1d9414efb937629604d929472b6567daeabc50e1b9d04c19d92150fca1eeeb1e
MD5 hash:
3a4adcb31476638859cfcbd01f90d63a
SHA1 hash:
65c80659b74877af8217203eb10db24ea45aea73
Link:
https://www.unpac.me/results/0e88f5fc-f84c-450f-b8d4-72f8a3b53127/
SH256 hash:
bf45b415add34c4a9cfd28e2f0060a5771b452a290d4807cc66e5e0355b014c0
MD5 hash:
8b9bce00bcd650b996c0d67d57675de7
SHA1 hash:
53fe05a28f11fe48c60fd0d2c3dfdba6f7597a87
Link:
https://www.unpac.me/results/0e88f5fc-f84c-450f-b8d4-72f8a3b53127/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_1f3216f428f850be2c66caa056f6d821
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe bf45b415add34c4a9cfd28e2f0060a5771b452a290d4807cc66e5e0355b014c0

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/205377/

Comments


Avatar
zbet commented on 2021-11-12 21:51:46 UTC

url : hxxp://xetwau08.top/download.php?file=file.exe