MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0c2ffb2664b0757fa896299577579cb6bd7a7e9dd601e11c13efcc7b5879e2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Cryptbot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0c2ffb2664b0757fa896299577579cb6bd7a7e9dd601e11c13efcc7b5879e2d
SHA3-384 hash: bcba62491ee660a918279b3168a6456ada58d2409fc5f73e8785c24b7b73d34f2c56cc9a59b51d229c789607a009009a
SHA1 hash: 7c1235168f940a977a7740f10e1e094fce4600a0
MD5 hash: 8ecd34ec6d7113125f8aa7d811068da7
humanhash: carpet-blue-equal-finch
File name:8ecd34ec6d7113125f8aa7d811068da7.exe
Download: download sample
Signature Cryptbot
Create hunting rule
File size:1'908'530 bytes
First seen:2021-07-19 15:32:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bf6171d5e900bf93e668170d1a189f34 (4 x CryptBot, 1 x Amadey, 1 x RedLineStealer)
ssdeep 49152:FIXQOaytd/QlJk3WQJjOiANo4NR5+FSP9:FIFPtd/QsWQRwmFSP9
Threatray 415 similar samples on MalwareBazaar
TLSH T1F1951242F293F838C592F2327A12EA7502E0AD23D61406C777D4EF5B79E1781B2E5636
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
145
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8ecd34ec6d7113125f8aa7d811068da7.exe
Verdict:
Malicious activity
Analysis date:
2021-07-19 15:36:22 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/8ad2f8d3-f4a4-4915-8a5c-62599379c8f1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/172584/
Detection(s):
Win.Malware.Alien-9879821-0
Create hunting rule

SecuriteInfo.com.Trojan.Siggen14.42168.5400.4588.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/130f77d5-b126-4a91-a8fe-d27d594e8931
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.spyw.evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/818410
Signature
Contains functionality to register a low level keyboard hook
Multi AV Scanner detection for submitted file
Obfuscated command line found
Submitted sample is a known malware sample
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 450825 Sample: DlF88VEqCs.exe Startdate: 19/07/2021 Architecture: WINDOWS Score: 64 41 Multi AV Scanner detection for submitted file 2->41 9 DlF88VEqCs.exe 7 2->9         started        process3 dnsIp4 33 192.168.2.1 unknown unknown 9->33 43 Contains functionality to register a low level keyboard hook 9->43 13 cmd.exe 1 9->13         started        signatures5 process6 signatures7 45 Submitted sample is a known malware sample 13->45 47 Obfuscated command line found 13->47 49 Uses ping.exe to sleep 13->49 51 Uses ping.exe to check the status of other devices and networks 13->51 16 cmd.exe 3 13->16         started        19 conhost.exe 13->19         started        process8 signatures9 37 Obfuscated command line found 16->37 39 Uses ping.exe to sleep 16->39 21 PING.EXE 1 16->21         started        24 Ricuperato.exe.com 16->24         started        26 findstr.exe 1 16->26         started        process10 dnsIp11 31 127.0.0.1 unknown unknown 21->31 28 Ricuperato.exe.com 24->28         started        process12 dnsIp13 35 BPUlISpihMrHp.BPUlISpihMrHp 28->35
Detection:
cryptbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d0c2ffb2664b0757fa896299577579cb6bd7a7e9dd601e11c13efcc7b5879e2d/
Threat name:
Win32.Trojan.Graftor
Create hunting rule
Status:
Malicious
First seen:
2021-07-18 18:50:29 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
18ccb7df2f91787a9392bf60d2f7019c86af65584c8a9c4846dee62e3240912a
Cryptbot
3d3bd7e7f5fabaf2510cf58eb74a9474b44c5d1389538ee7a93826a25531bd56
Cryptbot
571b3f0b4685473b424f7fb3b67344cd1441930fa7f966e3a4cd41875fde8de3
Cryptbot
5bddc130613ede4832dd4251843b168282b71c4eedfdb1772fd83bf08979ed32
Cryptbot
7c3ec59724f79c69f7bb889f8dac9e89a45ad3629a25c954c26905b5b953e3f5
Cryptbot
8917ae786634a933e9966e126f003bc6f994a34bab5209d9bb783f12b5ce63a5
Cryptbot
e19e0e7f8871e7acf07a37b277b5aaf2aa125f28ee11644c335eb313ec768df5
Cryptbot
e5dae08e748e408a4a256bd0c5d216281596a20399ea0127ac35b1661248b3ea
Cryptbot
f2a7cc00ce9933490e51df2d5df9e7b0b2165c73297a9fa8a99fbf51b85926b8
Cryptbot
+ 405 additional samples on MalwareBazaar
Result
Malware family:
cryptbot
Create hunting rule
Score:
  10/10
Tags:
family:cryptbot discovery spyware stealer
Link:
https://tria.ge/reports/210719-9nkh2bh942/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
CryptBot
Unpacked files
SH256 hash:
d0c2208cac9cf894507b4d442c821dc2d85fd7fbb0d0ff5bc181cec4b3bfc6b9
MD5 hash:
7d0827371ad8d2a3c017fdd9b380edd3
SHA1 hash:
c2c1f423b6d22dc91b69e2261bd447e7f9f18640
Link:
https://www.unpac.me/results/1d718224-f7a0-4fa5-93c6-8e4bdc67e251/
Parent samples :
c9e1de1c6ddd3ffd9c87ebdbcf9bd5b7064af9f60f650ae50573b05a49af8327
1e71bcb4133949eaa1bead27b4e01f03f7802c6b92f61acbb6b8d7c8faf419d7
3ecf5237981fc6575586fe2e13f9afe240b132b58d7bc071296ec3816b150d26
bbfda112b2d2742ec593b14cf9a0d2558cedaa24ae89d0cc9b5c94b94705c772
feb872b8a43d6a65ed3aa7e97dfa6c729c9e6fdf31ca913cbdbf2051d990fd36
f8387262e71195a4db4a0ca0fe68b973e225b8dfe7b475580d19240a760d1e73
fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693
5e30143f53af82ff891d9801ccff6b30e3dc7f3401bba597accb26e2d3b8b25d
fa5995b67f40f6c2cf7f3edba1e5a2213f2b083a35b13503af7a6203b4b8c33a
a6b218813c937087c078983f17d2520b0c2e7ad5d0cc41bfdf1d0cb540e4470a
440a157bbd8c8332d4edc63e6dc1399777e73bfb7ef3c5a356ab98fa56d1feea
95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874
007c6dfe4466894d678c06e6b30df77225450225ddd8e904e731cab32e82c512
9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba
c71463ac4fb8dd985b249b61e54888137bea84dab7c202546e230eb450fc0969
34b896d2e6470b2bd8facb9a796e0a521b78ec4956a573b5b38cacdc42622caa
8b738c9057baa2c3219120919226e95659cccec0dc61aca579bba58c7090719e
f6b2cd5327818418db45f70ed99bc6751d836eaf503a9bf33602af0c74f61e83
b426a6cb4005e266bf9b91b30d46fbbd0d6c541ac40d295aa99b8b7ef45e0edf
d43af0c0a5058412c903698b4ac55f150f6a20cac43344b5a596906780dac1f7
b4ca0b94b1a4e5b2ed28ad66c2df781b5add3c46cf5232b64b3a5253bcc341e8
1d40c76cecaabdf1e1d0004aa15cb469aa4374d1d0b2e48a47e588b1f84113d6
afdb413119fa2e0755a4885146d44547b97096d700d2b1236c6aba8f9bb9719d
7e74f3e8d070de8a3d3488dc7e68281d2450f28f79ee84edf3e0ea7c62bd7f91
d11d8d13e611c17ae61db286984170b2eb6802d2c23630e3211b9cfddaef09e6
d1dae6a275073c722606d35b783b4d176c0d8e0feff6c903c27ab9f0f8d7ab07
7c86e8c4143be0e27af9558ca46b3b4d7c5bee5e58e18902757bc02f6a3863a2
28319673d8f382142e223302ede1e0e497ccac2cd7a9814715726335e78c29c7
b130fe2fceada2a1980b6a0015c1bc1a9c1ee08f6229d99e43de82351da541fa
48a4042854a402824d35f4c95aed1e448d652d79ed0c251635acbc073200dfcf
e1f193deaa71595b668320d294635988f66c0f1ab1ab218e08fe3ae87fe10838
90f608b784fc8eac0a899d6aec257ec4beaf836e0cc808c7496f131aba61bef0
8435702911a3d6ebac7acef5aff7bc30395427892c1ddf39647b912a93260258
5bbb7a91ebfa925b0765103006bdde91f19c648ae792fab9dbc73832f3b2423c
SH256 hash:
d0c2ffb2664b0757fa896299577579cb6bd7a7e9dd601e11c13efcc7b5879e2d
MD5 hash:
8ecd34ec6d7113125f8aa7d811068da7
SHA1 hash:
7c1235168f940a977a7740f10e1e094fce4600a0
Link:
https://www.unpac.me/results/1d718224-f7a0-4fa5-93c6-8e4bdc67e251/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d0c2ffb2664b0757fa896299577579cb6bd7a7e9dd601e11c13efcc7b5879e2d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Cryptbot

Executable exe d0c2ffb2664b0757fa896299577579cb6bd7a7e9dd601e11c13efcc7b5879e2d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1393651/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/172584/

Comments