MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd158cfbdcd34d40c35e6e0c2aaccdff0049114e9e196cf4d582a8101e79f4ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptOne


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd158cfbdcd34d40c35e6e0c2aaccdff0049114e9e196cf4d582a8101e79f4ba
SHA3-384 hash: cfb38e56bac4340ea0f1a7f24ca688695f2ee39c43eaeb425317bbd1c3877648d95030b4e44bb910fb38c394c7ac9cb5
SHA1 hash: 220db515b7ef708a7bc77f9f0636b1627a81065a
MD5 hash: 1b1d6a59902a2dc71fb73a1b0525a668
humanhash: rugby-football-arkansas-single
File name:1b1d6a59902a2dc71fb73a1b0525a668.dll
Download: download sample
Signature CryptOne
Create hunting rule
File size:1'748'808 bytes
First seen:2022-11-23 13:34:46 UTC
Last seen:2022-11-23 16:32:34 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 903ed1180eec70301946eda8e1f16778 (1 x CryptOne)
ssdeep 24576:Y4Df5rev4L3w8O05BNZJO5rFyy6+xZ9DMJq8gF2PcCx98Gcw3cwR:YiqgL3bO09OpN6+xwJqPyvz3zR
Threatray 19 similar samples on MalwareBazaar
TLSH T197850236F6D18437E23365389C5F52B4A435BE48292D6C5A7BE81C8C4F353A139293AF
TrID 47.6% (.EXE) Win32 Executable Delphi generic (14182/79/4)
15.1% (.EXE) Win32 Executable (generic) (4505/5/1)
10.0% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
6.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter abuse_ch
Tags:CryptOne dll

Intelligence

File Origin
# of uploads :
2
# of downloads :
175
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/337629/
Detection(s):
SecuriteInfo.com.FileRepMalware.6654.29080.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/637e218c5be128ac718e7f62/reports/d2b93b13-389c-4329-a0ad-69a44d11006f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/38617ada-4956-43a8-8bde-2239445f745e
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1120120
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 752833 Sample: ztdnKc4uUh.dll Startdate: 23/11/2022 Architecture: WINDOWS Score: 72 17 Antivirus / Scanner detection for submitted sample 2->17 19 Multi AV Scanner detection for submitted file 2->19 21 Yara detected CryptOne packer 2->21 23 Machine Learning detection for sample 2->23 7 loaddll32.exe 1 2->7         started        process3 signatures4 25 Contains functionality to detect sleep reduction / modifications 7->25 10 cmd.exe 1 7->10         started        12 conhost.exe 7->12         started        process5 process6 14 rundll32.exe 10->14         started        signatures7 27 Contains functionality to detect sleep reduction / modifications 14->27
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd158cfbdcd34d40c35e6e0c2aaccdff0049114e9e196cf4d582a8101e79f4ba/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-11-23 11:59:50 UTC
File Type:
PE (Dll)
Extracted files:
38
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ukyz6642ngubq26nygcvlgn74aesekotymwz5gvqkubahtz6s5a._file
Verdict:
malicious
Similar samples:
1b9b939987259dbc440b01652002d0342b79828b03802c9406b131ff5b9543b6
CryptOne
302dfc5efc8e718d945f625aa4b9b7632de9dd309ef8ea579dd41cc5468ff3ab
CryptOne
4344b8091ea83418d19a29894058c65b13eb3d932f20abe830da3bf4723e8c3f
CryptOne
5054781b994f42d244814933d545cb9af0869e88d79a6278a8629e8172bf20c0
CryptOne
72aebf59fb0ae3273d59d9e240c481e2875ce4cd2606ac398866d40375976037
CryptOne
872fc5334462ab521c7ec62c847a1cba6fc068f3e3c49ec5920448b54cb12412
CryptOne
a4e15343b2e2cce48395d926ce1324985a244de5ebc8f42774d31e8c2c9e78a5
CryptOne
b30ce43f28704e02b07399433e0da63b476097f51a06848077ed9bc9c01d0dc2
CryptOne
f46ade4fe12048babf7950ffeca4678809629af3710e538918029b4f2a904aa7
CryptOne
+ 9 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221123-qvp48shh8t/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
b78d674e2a5180e4d6a0005a2f6d24cdf665a7a1ee84148a8592483d6f312010
MD5 hash:
f8de4305fe6f33077609e35b8f7cf32e
SHA1 hash:
d259c70a80a4a72e3ed89f98f7994c20155da997
Link:
https://www.unpac.me/results/9096b270-b0db-4b0c-a425-abc33ad27a75/
SH256 hash:
dd158cfbdcd34d40c35e6e0c2aaccdff0049114e9e196cf4d582a8101e79f4ba
MD5 hash:
1b1d6a59902a2dc71fb73a1b0525a668
SHA1 hash:
220db515b7ef708a7bc77f9f0636b1627a81065a
Link:
https://www.unpac.me/results/9096b270-b0db-4b0c-a425-abc33ad27a75/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/dd158cfbdcd3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.46
Link:
https://yomi.yoroi.company/submissions/dd158cfbdcd34d40c35e6e0c2aaccdff0049114e9e196cf4d582a8101e79f4ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptOne

DLL dll dd158cfbdcd34d40c35e6e0c2aaccdff0049114e9e196cf4d582a8101e79f4ba

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2431569/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2431570/
  
URLhaus
https://urlhaus.abuse.ch/url/2431573/
Cape
Cape
https://www.capesandbox.com/analysis/337629/

Comments