MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9cf9521886aaa99c317b33c9fd5a8f82be1fe61d8616bc6ce8a10c4d26b6e21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CryptBot

Vendor detections: 10

Intelligence 10 IOCs YARA 5 File information Comments

SHA256 hash:	c9cf9521886aaa99c317b33c9fd5a8f82be1fe61d8616bc6ce8a10c4d26b6e21
SHA3-384 hash:	4d221cb3b4acdbaf9e806622585aa0d3061e7f1d47f265fc40fadefe6ffd2eb7a91911d317d5345c938b7491f8012dce
SHA1 hash:	33e928ccbe9fb3088a0e94ece28b39cc9ccac8ef
MD5 hash:	eb6b6b4f0970c825bbde733784027a52
humanhash:	india-failed-failed-iowa
File name:	eb6b6b4f0970c825bbde733784027a52.exe
Download:	download sample
Signature	CryptBot Create hunting rule
File size:	3'123'712 bytes
First seen:	2021-08-25 18:13:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f8d9e6f58bdad8d3f277d01c805576b3 (7 x CryptBot)
ssdeep	49152:RPO2xOD0wD6XH67JeVIE1iplrlhwaT4dn/kFjkOWS356NhOHYGWOBJZ8bCd4YIg:R22a0oJeKEwBln4dcFjCC6NhEvWOvk
TLSH	T127E5334DB50A7A02CE61197187B8C5C0BFA2D992A75F11702E0F59BE9A1223E4FFF711
Reporter	abuse_ch
Tags:	CryptBot exe

Intelligence

File Origin

# of uploads :

# of downloads :

228

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

eb6b6b4f0970c825bbde733784027a52.exe

Verdict:

Malicious activity

Analysis date:

2021-08-25 18:18:23 UTC

Tags:

trojan stealer

Link:

https://app.any.run/tasks/5f1469d5-f8e9-4ea1-97a0-7a36837d5e4f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

CryptBot

Link:

https://www.capesandbox.com/analysis/182397/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Running batch commands

Creating a process with a hidden window

Creating a file in the Program Files subdirectories

Launching a process

Launching cmd.exe command interpreter

Creating a file in the %AppData% subdirectories

Searching for analyzing tools

Searching for the window

Creating a file in the %temp% subdirectories

Delayed reading of the file

Deleting a recently created file

Reading critical registry keys

Creating a window

Sending a UDP request

DNS request

Connecting to a non-recommended domain

Connection attempt

Sending an HTTP POST request

Sending an HTTP GET request

Creating a file

Creating a process from a recently created file

Stealing user critical data

Enabling autorun by creating a file

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/92fccb85-d02b-49e7-93bc-ce1000ce4ef2

Result

Threat name:

Cryptbot Glupteba

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/839293

Signature

Antivirus / Scanner detection for submitted sample

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Yara detected Cryptbot

Yara detected Glupteba

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c9cf9521886aaa99c317b33c9fd5a8f82be1fe61d8616bc6ce8a10c4d26b6e21/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-08-25 15:54:39 UTC

AV detection:

16 of 42 (38.10%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zhhzkiminkvjtqyxwm6j7vni7av6d7tb3bqwxrworiimjutlnyqq._file

Result

Malware family:

danabot

Score:

10/10

Tags:

family:danabot banker discovery evasion spyware stealer themida trojan

Link:

https://tria.ge/reports/210825-btkwkedtzx/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Modifies registry class

Modifies system certificate store

Runs ping.exe

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

NSIS installer

Enumerates physical storage devices

Drops file in Program Files directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks BIOS information in registry

Deletes itself

Drops startup file

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Themida packer

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Danabot

Danabot Loader Component

Unpacked files

SH256 hash:

798739aadd30f8de680d2150f3b86a14cc4f60199c8dcfc05ea12c3cc178bd48

MD5 hash:

c69f337e83c56ad0ae2c93947d18d914

SHA1 hash:

7202a078787c68e96c8e3b7e50bdce3fbe8c7bc8

Link:

https://www.unpac.me/results/14194bad-4dfe-449c-8376-61da992b3c51/

SH256 hash:

c9cf9521886aaa99c317b33c9fd5a8f82be1fe61d8616bc6ce8a10c4d26b6e21

MD5 hash:

eb6b6b4f0970c825bbde733784027a52

SHA1 hash:

33e928ccbe9fb3088a0e94ece28b39cc9ccac8ef

Link:

https://www.unpac.me/results/14194bad-4dfe-449c-8376-61da992b3c51/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/c9cf9521886a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c9cf9521886aaa99c317b33c9fd5a8f82be1fe61d8616bc6ce8a10c4d26b6e21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_Themida Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with Themida

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers