MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd725d660f9ce7a4cdef0048df227215123dd032ecd7479fa9e39f0da36fc1c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

CryptOne

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	cd725d660f9ce7a4cdef0048df227215123dd032ecd7479fa9e39f0da36fc1c6
SHA3-384 hash:	e3b3cc315130af3d7303d9fec404ed2516775cce8cd2e7c61453d6c62bbbe5f882e9141a41c705361cc8cbec6d590623
SHA1 hash:	b4d816dbdc214fe5c05dfd1651be5c893e4a8346
MD5 hash:	009297b1a22d1b81b4a9024bcaa07382
humanhash:	glucose-virginia-cup-beer
File name:	009297b1a22d1b81b4a9024bcaa07382.exe
Download:	download sample
Signature	CryptOne Create hunting rule
File size:	1'615'036 bytes
First seen:	2023-02-12 19:19:10 UTC
Last seen:	2023-02-12 20:35:01 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	91e96141ed5dbe3bc541c8aad7ff3c38 (22 x CryptOne, 7 x njrat, 5 x DCRat)
ssdeep	49152:WBqaaG+hjNW6EPKqXBPG7hceH2cYopsMPg:WBqan+tI68qtceH2zB
TLSH	T1C875232179C1C4B1D46B14344DA9A7B2AB78BC305F76CAD79B882F6D8F300D1A931B67
TrID	91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4505/5/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter	abuse_ch
Tags:	CryptOne exe

Intelligence

File Origin

# of uploads :

# of downloads :

211

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

009297b1a22d1b81b4a9024bcaa07382.exe

Verdict:

Malicious activity

Analysis date:

2023-02-12 19:23:57 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f3c327f4-9c9d-44f5-97ae-47c8b171622a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/364571/

Detection(s):

SecuriteInfo.com.Variant.Fugrafa.267521.27767.29977.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Launching a process

Sending a custom TCP request

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/68662/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-vm greyware overlay packed packed setupapi.dll shdocvw.dll shell32.dll

Link:

https://www.filescan.io/uploads/63e93be4c586fd8a755dab70/reports/b6b60ce6-7e6e-4a2a-8540-af3cd5f605b6/overview

Verdict:

Malicious

Labled as:

Fugrafa.Generic

Link:

https://www.hybrid-analysis.com/sample/cd725d660f9ce7a4cdef0048df227215123dd032ecd7479fa9e39f0da36fc1c6

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/52aa145b-1b8c-4707-8357-83466b362186

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1172739

Signature

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cd725d660f9ce7a4cdef0048df227215123dd032ecd7479fa9e39f0da36fc1c6/

Threat name:

Win32.Trojan.Fugrafa

Status:

Malicious

First seen:

2023-02-12 19:20:24 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

18 of 26 (69.23%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zvzf2zqpttt2jtppaben6itscujd3ubs5tluph5j4opq3i3pyhda._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/230212-x132lsfh92/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

Unpacked files

SH256 hash:

cd725d660f9ce7a4cdef0048df227215123dd032ecd7479fa9e39f0da36fc1c6

MD5 hash:

009297b1a22d1b81b4a9024bcaa07382

SHA1 hash:

b4d816dbdc214fe5c05dfd1651be5c893e4a8346

Link:

https://www.unpac.me/results/5afb1792-1d37-4ea1-b456-f752c7ab527e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cd725d660f9ce7a4cdef0048df227215123dd032ecd7479fa9e39f0da36fc1c6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.