MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c03eaff7de09fac9babacd633ac3d752fc6bf55df6dba1c247d6d74048c23e9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	c03eaff7de09fac9babacd633ac3d752fc6bf55df6dba1c247d6d74048c23e9c
SHA3-384 hash:	fdd2923a4ffeefda54eb3fd83198dfbb91a9f29171af2b736381a03a6025c80cc4f6ad651962cc2b25d9fe3c12011714
SHA1 hash:	3355a140a5ee81b38f3f740d8592af0eb5205c78
MD5 hash:	2aa2eaba8971df4bd996a3571ac525dd
humanhash:	fanta-spring-kilo-cup
File name:	Crypto Ultimate BOT AI 2.3.exe
Download:	download sample
File size:	389'120 bytes
First seen:	2023-08-03 07:10:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 71 x LummaStealer, 61 x Rhadamanthys)
ssdeep	6144:uaM5VkHAkucoc2lih6rEXfJiyE+7tmXcKVRGVO4Ap421/7JY3q:uNM1uxc5UEXBh57IXcLINzUq
TLSH	T126848C095EE42C75F867B2FCC4B5816E63337A5007B496DF11878EBA1B32B80A53AF05
TrID	83.0% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 6.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 4.4% (.EXE) Win64 Executable (generic) (10523/12/4) 2.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.8% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):
dhash icon	0f33694d4d69694f (1 x RedLineStealer)
Reporter	vmovupd
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

263

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Crypto Ultimate BOT AI 2.3.exe

Verdict:

Malicious activity

Analysis date:

2023-08-03 07:10:26 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/4da0942c-4087-45d7-a482-88407d966476

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/439990/

Detection(s):

SecuriteInfo.com.Trojan.Inject4.18513.31275.18664.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Сreating synchronization primitives

Creating a file

Launching a process

Creating a window

Creating a file in the Windows subdirectories

Moving a file to the Windows subdirectory

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Unauthorized injection to a recently created process

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

advpack CAB control explorer installer lolbin lolbin masquerade packed replace rundll32 setupapi shell32

Link:

https://www.filescan.io/uploads/64cb53074e7fe43c670589d3/reports/9d62fd19-ce3f-499e-b065-fd4b0a5aef20/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/c03eaff7de09fac9babacd633ac3d752fc6bf55df6dba1c247d6d74048c23e9c

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/bcb357f0-1b6e-4061-ab1b-49fe24c09027

Result

Threat name:

MicroClip

Detection:

malicious

Classification:

troj.adwa.evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1284887

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c03eaff7de09fac9babacd633ac3d752fc6bf55df6dba1c247d6d74048c23e9c/

Threat name:

Win64.Trojan.Nekark

Status:

Malicious

First seen:

2023-08-03 07:11:05 UTC

File Type:

PE+ (Exe)

Extracted files:

325

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ya7k7566bh5mtov2zvrtvq6xkl6gx5k563n2dqsh23luasgch2oa._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

7/10

Tags:

persistence

Link:

https://tria.ge/reports/230803-hzx2msbh48/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Windows directory

Drops file in System32 directory

Adds Run key to start application

Drops startup file

Executes dropped EXE

Loads dropped DLL

Unpacked files

SH256 hash:

c03eaff7de09fac9babacd633ac3d752fc6bf55df6dba1c247d6d74048c23e9c

MD5 hash:

2aa2eaba8971df4bd996a3571ac525dd

SHA1 hash:

3355a140a5ee81b38f3f740d8592af0eb5205c78

Link:

https://www.unpac.me/results/db9deabb-0b43-460c-833d-3bde1e0ea601/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.