MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e366497c19208fe45bd04dd3d83f4ec71108b2cefeb4fdaeb60e139743c8bb40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e366497c19208fe45bd04dd3d83f4ec71108b2cefeb4fdaeb60e139743c8bb40
SHA3-384 hash: 7ca3c3f6bc07f77c244a91913414ca3af597b63bce2f2fdf1f185110e25dd26e25098755b50c5c2b7cf32bfe0d54641d
SHA1 hash: 03021b6bf23e45c1347ac4218bd6779c13cab6e0
MD5 hash: 0aa3cc98fae581989a1d69e57072983f
humanhash: twelve-lithium-london-four
File name:0aa3cc98fae581989a1d69e57072983f
Download: download sample
Signature CryptBot
Create hunting rule
File size:382'464 bytes
First seen:2021-10-19 15:32:46 UTC
Last seen:2021-10-19 15:33:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 95764cd3a93b27321012d20c57632d43 (1 x Smoke Loader, 1 x CryptBot, 1 x RedLineStealer)
ssdeep 6144:7x/0+kiruab/C8fEjlb5rh7o18WIdLGhixXBpqX7tNfVXVHQLIiu8cfo0/pW:7N0+tuabFulbdIpIdCoxXTwZGEX8cA0U
Threatray 6'678 similar samples on MalwareBazaar
TLSH T10C84CF3076B0D822DB7115308828C7E5557AF849DA20F55633F4EBAF2EB128997F139E
File icon (PE):PE icon
dhash icon fcfcb4f4d4d4d8c0 (19 x RedLineStealer, 16 x RaccoonStealer, 14 x Smoke Loader)
Reporter zbetcheckin
Tags:32 CryptBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
419
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Click_here (1).zip
Verdict:
Malicious activity
Analysis date:
2021-10-19 12:29:46 UTC
Tags:
evasion trojan opendir rat redline stealer vidar loader
Link:
https://app.any.run/tasks/5e40b466-cfda-4482-9db9-58860806c983

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/198635/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.18714.29161.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/616ee5319a5a1e91c5c6cd83/reports/d95d724e-8c1c-4241-a281-c089fa3be8f1/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
Cryptbot Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/873297
Signature
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Self deletion via cmd delete
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Cryptbot
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 505726 Sample: rr7d2ywO4Z Startdate: 19/10/2021 Architecture: WINDOWS Score: 100 67 Multi AV Scanner detection for submitted file 2->67 69 Yara detected Glupteba 2->69 71 Yara detected Cryptbot 2->71 73 7 other signatures 2->73 8 rr7d2ywO4Z.exe 46 2->8         started        13 IntelRapid.exe 2->13         started        15 IntelRapid.exe 2->15         started        process3 dnsIp4 59 tyncel11.top 92.53.107.127, 49787, 49793, 80 TIMEWEB-ASRU Russian Federation 8->59 61 veoqkb22.top 91.203.193.70, 49752, 80 GARANT-PARK-INTERNETRU Russian Federation 8->61 63 morpib02.top 195.133.10.247, 49778, 80 FLEX-ASRU Russian Federation 8->63 49 C:\Users\user\AppData\Local\Temp\File.exe, PE32 8->49 dropped 51 C:\Users\user\AppData\Local\...\lv[1].exe, PE32 8->51 dropped 99 Detected unpacking (changes PE section rights) 8->99 101 Detected unpacking (overwrites its own PE header) 8->101 103 Self deletion via cmd delete 8->103 105 Tries to harvest and steal browser information (history, passwords, etc) 8->105 17 File.exe 25 8->17         started        22 cmd.exe 1 8->22         started        107 Query firmware table information (likely to detect VMs) 13->107 109 Hides threads from debuggers 13->109 111 Tries to detect sandboxes / dynamic malware analysis system (registry check) 13->111 file5 signatures6 process7 dnsIp8 55 192.168.2.1 unknown unknown 17->55 41 C:\Users\user\AppData\Local\...\giliak.exe, PE32+ 17->41 dropped 43 C:\Users\user\AppData\Local\...\foulervp.exe, PE32 17->43 dropped 45 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 17->45 dropped 47 3 other files (none is malicious) 17->47 dropped 75 Machine Learning detection for dropped file 17->75 24 foulervp.exe 3 18 17->24         started        28 giliak.exe 4 17->28         started        31 conhost.exe 22->31         started        33 timeout.exe 1 22->33         started        file9 signatures10 process11 dnsIp12 65 ip-api.com 208.95.112.1, 49799, 80 TUT-ASUS United States 24->65 87 Antivirus detection for dropped file 24->87 89 Query firmware table information (likely to detect VMs) 24->89 91 May check the online IP address of the machine 24->91 97 2 other signatures 24->97 35 wscript.exe 12 24->35         started        53 C:\Users\user\AppData\...\IntelRapid.exe, PE32+ 28->53 dropped 93 Hides threads from debuggers 28->93 95 Tries to detect sandboxes / dynamic malware analysis system (registry check) 28->95 39 IntelRapid.exe 28->39         started        file13 signatures14 process15 dnsIp16 57 iplogger.org 88.99.66.31, 443, 49800 HETZNER-ASDE Germany 35->57 77 System process connects to network (likely due to code injection or exploit) 35->77 79 May check the online IP address of the machine 35->79 81 Query firmware table information (likely to detect VMs) 39->81 83 Hides threads from debuggers 39->83 85 Tries to detect sandboxes / dynamic malware analysis system (registry check) 39->85 signatures17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e366497c19208fe45bd04dd3d83f4ec71108b2cefeb4fdaeb60e139743c8bb40/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-10-19 14:04:47 UTC
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ntes7azech6iw6qjxj5qp2oy4iqrmwo722p3lvwbyjzoq6ixnaa._file
Verdict:
malicious
Similar samples:
131d6fb9204ceda508075afce9b9b65e429952674e914d224268deb319a0aab1
CryptBot
25c212b01aed427cbe5c5e0f06e5edd0188f881551347aa20804b3da88da2af2
CryptBot
7d228085018d1f8ffdd1765cbc892a3c6886d81a156e25d053737597a6566112
CryptBot
9c183327a52687e89969b39d6e099f239161ce9876af0f8da666eb5e55c238c3
CryptBot
aa88fc6977bf02c959ffa6865b99eeee8c1735001f824d1bbcc4ff01d93fbb74
CryptBot
ab2c8662c8101b040f3b5e41eb3639b1be3ce9da6ac155f7a4b0fbe63bb3fde3
CryptBot
b0884a21366325f9e9242b357e7f3d5acf63b7b38e02988e1c1f3454230b5877
CryptBot
bff3d8677d0c866b3fa47a2176ba05c9ae03cc215794896f2ef922a1aa037097
CryptBot
d7fccfe57f600475492fa8d41dde2c2d0d74fdc8e4d7151cb280dfb030441872
CryptBot
e917d16aa3c2d421903d598a6c993da5e76ea3e393e460af5c8d6388a3c3c95f
CryptBot
+ 6'668 additional samples on MalwareBazaar
Result
Malware family:
danabot
Create hunting rule
Score:
  10/10
Tags:
family:cryptbot family:danabot botnet:4 banker discovery evasion spyware stealer suricata themida trojan
Link:
https://tria.ge/reports/211019-sy8f4ahaem/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Deletes itself
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
CryptBot
Danabot
Danabot Loader Component
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
Malware Config
C2 Extraction:
veoqkb22.top
morpib02.top
192.119.110.73:443
192.236.147.159:443
192.210.222.88:443
Unpacked files
SH256 hash:
242436c4dd7b5a729e0e36686ef4b02e26fc0247cde6e510415f8123f9179470
MD5 hash:
c42f2461cd3e1afad66fd2667336142e
SHA1 hash:
ae04d0b7f459148a8df58e832718a26008d365bc
Link:
https://www.unpac.me/results/a6a76c5c-1ca3-4ccc-bb72-82e148d5d672/
SH256 hash:
e366497c19208fe45bd04dd3d83f4ec71108b2cefeb4fdaeb60e139743c8bb40
MD5 hash:
0aa3cc98fae581989a1d69e57072983f
SHA1 hash:
03021b6bf23e45c1347ac4218bd6779c13cab6e0
Link:
https://www.unpac.me/results/a6a76c5c-1ca3-4ccc-bb72-82e148d5d672/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e366497c19208fe45bd04dd3d83f4ec71108b2cefeb4fdaeb60e139743c8bb40

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe e366497c19208fe45bd04dd3d83f4ec71108b2cefeb4fdaeb60e139743c8bb40

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/198635/

Comments


Avatar
zbet commented on 2021-10-19 15:32:49 UTC

url : hxxp://tynwod03.top/download.php?file=file.exe