MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db460c5aa2fac933fb349df4a547a31a78b5d5e39f0df6bca9746a50c45ad309. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	db460c5aa2fac933fb349df4a547a31a78b5d5e39f0df6bca9746a50c45ad309
SHA3-384 hash:	25b2be66e115b9de15439f3654ef81488d0354d126b9f1ae95bf15653c01d451d9a36ab92f90a3f53c14bc459114fb72
SHA1 hash:	b3a4aa038b46bf362e955d30662ebb865db88c59
MD5 hash:	b6a808a720e5a620d84374de290a5cbe
humanhash:	jersey-yellow-cat-oklahoma
File name:	b6a808a720e5a620d84374de290a5cbe.exe
Download:	download sample
Signature	CryptOne Alert Create hunting rule
File size:	1'762'138 bytes
First seen:	2023-07-02 06:03:51 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0e806fd55a4f41060c8e206a25d6875a (10 x CryptOne)
ssdeep	49152:OCWhF7BfJXAEsN6ooNxe5+oHEjSUSM8ALlKF:OCWhF7BfKEvxK9HRXnF
Threatray	523 similar samples on MalwareBazaar
TLSH	T18B852202BBC181B2C6661A324F75A731A57EF8305F54DACFD3A459ACE9305C09B393A7
TrID	88.3% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 4.7% (.EXE) Win64 Executable (generic) (10523/12/4) 2.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 2.0% (.EXE) Win32 Executable (generic) (4505/5/1) 0.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	b3b3b371716b93b3 (25 x CryptOne, 12 x RemcosRAT, 6 x RedLineStealer)
Reporter	abuse_ch
Tags:	CryptOne exe

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

270

Origin country :

NL

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/405142/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.Uztuby.2.32093.17062.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Launching a process

Certego Dragonfly Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/94739/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm crypto fauppod greyware lolbin msiexec msiexec overlay packed replace setupapi shdocvw shell32

Link:

https://www.filescan.io/uploads/64a1135751710bcd8d43c0a2/reports/26911458-b0a1-4b4e-b251-8b509c71ab0e/overview

Hybrid Analysis Trojan.Uztuby

Verdict:

Malicious

Labled as:

Trojan.Uztuby

Link:

https://www.hybrid-analysis.com/sample/db460c5aa2fac933fb349df4a547a31a78b5d5e39f0df6bca9746a50c45ad309

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Malicious

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1925f486-09ce-4aac-aba6-7e28fae09106

Joe Sandbox CryptOne

Result

Threat name:

CryptOne

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1264902

Signature

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Yara detected CryptOne packer

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db460c5aa2fac933fb349df4a547a31a78b5d5e39f0df6bca9746a50c45ad309/

ReversingLabs TitaniumCloud Win32.Trojan.Fauppod

Threat name:

Win32.Trojan.Fauppod

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-02 06:04:08 UTC

File Type:

PE (Exe)

Extracted files:

18

AV detection:

17 of 24 (70.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ndaywvc7leth6zutx2kkr5ddj4llvpdt4g7npfjorvfbrc22meq._file

Threatray malicious

Verdict:

malicious

Similar samples:

0a0c50dbc5d0c9811bfd0552ddd075e0e1df2cf07049cc546e41f9bf08cb8290

CryptOne

3f64e635a811969032be1c3bd6d467b6edae118ea00996a66e56e9d798a4db03

CryptOne

4508befe4b8012035c52c7aaccbe89b9f75919bdcc86feb8fe79ae01fdea8179

CryptOne

8525d0bc1e38bb74d592de9be2615da94ec0b81e611b0e456b3a51c40ab5baa3

CryptOne

a040c35ef32cbe289d5bc2b8014adcb961ab3aed1e2873d1f2e335933e97927b

CryptOne

cf76ac64d1038d54fa178a67712a4916e021b6b381241b44c2ceed7428ba4692

CryptOne

e905f262f2ec981ddf92c94fe44d96c14195f9bf0815f204c2c4197b16dbb053

CryptOne

+ 513 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

n/a

Link:

https://tria.ge/reports/230702-gsljlabh61/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Loads dropped DLL

UnpacMe 2

Unpacked files

SH256 hash:

c7fcf73951120f2826fea93a37b20a9102366258af37491cf5ba65e82f6ac022

MD5 hash:

83f6e08d9716a1c5e122bf4e50b278dd

SHA1 hash:

211b46518a1227d6960de8e05d361d5e6ee6e2e1

Link:

https://www.unpac.me/results/44edbadf-74c1-4066-b442-50fa876da80c/

SH256 hash:

db460c5aa2fac933fb349df4a547a31a78b5d5e39f0df6bca9746a50c45ad309

MD5 hash:

b6a808a720e5a620d84374de290a5cbe

SHA1 hash:

b3a4aa038b46bf362e955d30662ebb865db88c59

Link:

https://www.unpac.me/results/44edbadf-74c1-4066-b442-50fa876da80c/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/db460c5aa2fac933fb349df4a547a31a78b5d5e39f0df6bca9746a50c45ad309

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/405142/