MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KnightCrypt


Vendor detections: 10


Intelligence 10 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408
SHA3-384 hash: 1c5542d3be293f8b38ab421cc80e431e811c85b3f3ae08712a93e9f390deaca04d3486bfe0e865f675ffbe17a3875ae7
SHA1 hash: cf0dd52331ce203c723f7be32bd91d7cfb34a988
MD5 hash: 7defc0b43aa2ad389575df2419b7909b
humanhash: juliet-uncle-solar-indigo
File name:92.exe
Download: download sample
Signature KnightCrypt
Create hunting rule
File size:1'392'760 bytes
First seen:2023-09-03 10:10:11 UTC
Last seen:2023-09-27 06:58:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 92ed8fb21c381a073a5e7ca35347f90e (13 x KnightCrypt)
ssdeep 12288:0BVVtkNBJOlMmXP0447OdMyogfJ7gwPueClVVRWM5YDh8xpoPzouMA+nkGGCp+ME:tTcCG0447AMVgfdnTClVm4QzcGRGS
Threatray 21 similar samples on MalwareBazaar
TLSH T16D556B07B69941E8D43AC1B0CA564332EE71BC950F34A9DF0690B3592F7BEE46B3A711
TrID 63.5% (.EXE) Win64 Executable (generic) (10523/12/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 40317969e9e96000 (17 x KnightCrypt, 1 x Knight)
Reporter 1ZRR4H
Tags:89-23-98-56 exe KnightCrypt

Intelligence

File Origin
# of uploads :
3
# of downloads :
316
Origin country :
CL CL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
92.exe
Verdict:
No threats detected
Analysis date:
2023-09-03 10:12:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b50c9c87-26db-4134-86c5-eeeaa97d0116

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/445849/
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Launching cmd.exe command interpreter
Creating a file in the %temp% directory
Launching a process
Creating a file in the mass storage device
Unauthorized injection to a system process
Encrypting user's files
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
90%
Tags:
anti-debug control explorer greyware lolbin overlay packed phishing shell32
Link:
https://www.filescan.io/uploads/64f45bb7560864d1b674443e/reports/d26b6c72-8110-42bf-bf59-1a00bb27e29b/overview
Verdict:
Malicious
Labled as:
Win64/Agent.CUP trojan
Link:
https://www.hybrid-analysis.com/sample/dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/08fa68d2-f7fb-470d-a5c5-6bc8e3311228
Result
Threat name:
KnightCrypt
Create hunting rule
Detection:
malicious
Classification:
evad.rans.expl
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1302387
Signature
Antivirus detection for dropped file
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Found evasive API chain (may stop execution after checking mutex)
Found hidden mapped module (file has been removed from disk)
Found ransom note / readme
Found Tor onion address
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
System process connects to network (likely due to code injection or exploit)
Writes a notice file (html or txt) to demand a ransom
Writes to foreign memory regions
Yara detected KnightCrypt Ransomware
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1302387 Sample: 92.exe Startdate: 03/09/2023 Architecture: WINDOWS Score: 100 44 Antivirus detection for dropped file 2->44 46 Multi AV Scanner detection for dropped file 2->46 48 Multi AV Scanner detection for submitted file 2->48 50 5 other signatures 2->50 7 92.exe 4 2->7         started        process3 dnsIp4 40 nginx.org 7->40 42 i.ibb.co 7->42 60 Writes to foreign memory regions 7->60 62 Maps a DLL or memory area into another process 7->62 11 cmd.exe 2 7->11         started        15 audiodg.exe 7->15         started        signatures5 process6 file7 32 C:\Users\user\AppData\Local\Temp\aymu, PE32+ 11->32 dropped 64 Injects code into the Windows Explorer (explorer.exe) 11->64 66 Writes to foreign memory regions 11->66 68 Found hidden mapped module (file has been removed from disk) 11->68 70 Maps a DLL or memory area into another process 11->70 17 explorer.exe 30 46 11->17         started        22 conhost.exe 11->22         started        signatures8 process9 dnsIp10 34 192.168.2.100 unknown unknown 17->34 36 192.168.2.101 unknown unknown 17->36 38 98 other IPs or domains 17->38 24 C:\Users\...\How To Restore Your Files.txt, ASCII 17->24 dropped 26 C:\Users\...\How To Restore Your Files.txt, ASCII 17->26 dropped 28 C:\Users\...\How To Restore Your Files.txt, ASCII 17->28 dropped 30 10 other malicious files 17->30 dropped 52 System process connects to network (likely due to code injection or exploit) 17->52 54 Connects to many different private IPs via SMB (likely to spread or exploit) 17->54 56 Connects to many different private IPs (likely to spread or exploit) 17->56 58 4 other signatures 17->58 file11 signatures12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-08-30 17:10:20 UTC
File Type:
PE+ (Exe)
Extracted files:
3
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3p44yzkgdr54muetqflng5i5jlqm4qys2oez65d6ledwpqhpaqea._file
Verdict:
malicious
Similar samples:
0701df6ec96aaea2af21707445fdfd8812dd8b7c7e695b920eedca205518826c
KnightCrypt
08d8bd49d5248a1ceca14cd69f327f6685dbc44887aab5a14eb79c71baa123c1
KnightCrypt
3fbedfb9ae1e9bcef7983491124e3a50937f9c5209b7cfc2614197a2e8045cfb
KnightCrypt
5ebc114af099dbf4ce24cd2cad3e5ab783383d2217520e162fcc21feca88d3b9
KnightCrypt
66871cebfa92f04476679fb3b00a125f7eb43ea35cfb8b187b4aa2bbd0230c10
KnightCrypt
7aa4903001e55982d11c76c178d9006aaaf137c5a941067cc6bf1b91edde62a1
KnightCrypt
b6064f6936f72d1312f40f86f0cb889c6d0477c20f59c6c96c385c6287f701f7
KnightCrypt
bb65532e8a52e282d98938031c0d75155082933524924d01de4246e12690cf9c
KnightCrypt
e62d6e57a7ab153771d9c550062cc67f6d5befcc52286bd6f1543201f7088acd
KnightCrypt
f2e2427107648e8d7be5f4e42341c702ceddb442191434128cbbf15c0325d8e9
KnightCrypt
+ 11 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
ransomware
Link:
https://tria.ge/reports/230903-l7xydshd87/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Suspicious use of SetThreadContext
Drops desktop.ini file(s)
Enumerates connected drives
Renames multiple (172) files with added filename extension
Unpacked files
SH256 hash:
dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408
MD5 hash:
7defc0b43aa2ad389575df2419b7909b
SHA1 hash:
cf0dd52331ce203c723f7be32bd91d7cfb34a988
Link:
https://www.unpac.me/results/381c6eb5-2057-452a-b4d1-c0b9b7d2d64d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dbf9cc65461c7bc650938156d3751d4ae0ce4312d3899f747e590767c0ef0408

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/445849/

Comments