MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e601a9b4dc605b4e283a5b97ed2cb16da2e754b7a6c27585c6f0d1cdbed99094. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptOne


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e601a9b4dc605b4e283a5b97ed2cb16da2e754b7a6c27585c6f0d1cdbed99094
SHA3-384 hash: b27917ca102d138e31c6cb2c9dccb0b5413b3e6198d6d21849870378b1d124ed82f58efab52b3b63084033d5b59c134e
SHA1 hash: d52ff0233ce498c16e3f043ed7bf01259ffba82b
MD5 hash: fd31f10421c89f733fdbeace88e3581e
humanhash: georgia-seventeen-delta-floor
File name:file
Download: download sample
Signature CryptOne
Create hunting rule
File size:1'562'673 bytes
First seen:2022-11-12 17:35:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 12e12319f1029ec4f8fcbed7e82df162 (389 x DCRat, 52 x RedLineStealer, 51 x Formbook)
ssdeep 24576:QTbBv5rUwXVr7zGVBNE6THIsbkowLYTxR5kacOSYUKaMAJ2M7WKRKQAngV:CBDrcfE6TtbkwT5Oh9Mc2M7WKRKHI
Threatray 2'152 similar samples on MalwareBazaar
TLSH T194752242B9D19DB3E17218321A74AB31A43D7D202F398EDFA3C46A6EC9315C1DB31766
TrID 89.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39)
3.5% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
1.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne)
Reporter jstrosch
Tags:CryptOne exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
196
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-11-12 17:37:18 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e0f1ff48-1d44-4b8f-9501-da60032ef546

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/332988/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.38920448.13962.7593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/51745/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/636fd9834834ec1f25eef076/reports/d444f8f7-a98f-4041-a735-1cd739f944e2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e6f461ea-105b-4c8d-b94f-c4a6592a7d04
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1111935
Signature
Antivirus detection for dropped file
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 744630 Sample: file.exe Startdate: 12/11/2022 Architecture: WINDOWS Score: 80 22 Antivirus detection for dropped file 2->22 24 Multi AV Scanner detection for dropped file 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 3 other signatures 2->28 9 file.exe 3 8 2->9         started        process3 file4 20 C:\Users\user\AppData\Local\Temp\X5Poy.cpl, PE32 9->20 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        process7 16 rundll32.exe 14->16         started        process8 18 rundll32.exe 16->18         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e601a9b4dc605b4e283a5b97ed2cb16da2e754b7a6c27585c6f0d1cdbed99094/
Threat name:
Win32.Trojan.CrypterX
Create hunting rule
Status:
Malicious
First seen:
2022-11-12 17:36:18 UTC
File Type:
PE (Exe)
Extracted files:
78
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ya2tng4mbnu4kb2lol62lfrnwroovfxu3bhlbog6di43pwzscka._file
Verdict:
malicious
Similar samples:
10f1d986b6f2654efc7755aa433247b63228ce237a97f9eb29bfb74d0b602acd
CryptOne
2709f083327060b896501645e3263462cf0e329645e41f6d4556276904c51856
CryptOne
301a3e665000c99ab655a74dbf9408de24875866528be4f6d28e83490c19305b
CryptOne
3a0597925d2b7686d2386591f60a7abe686c0e10e2e164405270cc0d83e4b128
CryptOne
4ca4415993e8bead0b3a27efb2f31a36e551a3f7d5bcb97d29e6700653198173
CryptOne
62ffc5fabaf9853f0b3821f6dffbb876c7d38f7f68d4b7d14b9fc4fc0fddc36d
CryptOne
7571b1e23ad03a0ce6c5a1dd2593eb01bb7ffcf42e192d4e0cfef32ce493609e
CryptOne
c787c9a5f407a656478efc835f1a0f8f738030bf26cedbd4748cb7b18ed2ea3e
CryptOne
e9f669028697238e2a9a181b9e409909695d03eccd09a35db30729fb51952527
CryptOne
+ 2'142 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221112-v6kfcaca2x/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/68e94955-ac1b-4b35-bf2a-ebd50d6aa3b4
Unpacked files
SH256 hash:
d83965a833a4594634d65febfe9b0cdde75c690f4c1edf4c7624ffd2d6c29508
MD5 hash:
dde1bd9425faa2c15bbe7b5b7beeed30
SHA1 hash:
6c77652df1c1d75f13c187ac99d5b03e24f7df1a
Link:
https://www.unpac.me/results/0f5655f5-f57a-4947-981e-0184b41e0bd7/
SH256 hash:
eb4b20df7f144fdf44297c7973d52b7ba83118f5e021ec2e889c2fcbf14650e9
MD5 hash:
504cc1c83705a67c2d7984358474f4de
SHA1 hash:
8275e86ca3c9b5bff02f8f6f209a1f181fef0662
Link:
https://www.unpac.me/results/0f5655f5-f57a-4947-981e-0184b41e0bd7/
SH256 hash:
e601a9b4dc605b4e283a5b97ed2cb16da2e754b7a6c27585c6f0d1cdbed99094
MD5 hash:
fd31f10421c89f733fdbeace88e3581e
SHA1 hash:
d52ff0233ce498c16e3f043ed7bf01259ffba82b
Link:
https://www.unpac.me/results/0f5655f5-f57a-4947-981e-0184b41e0bd7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e601a9b4dc605b4e283a5b97ed2cb16da2e754b7a6c27585c6f0d1cdbed99094

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:sfx_pdb
Create hunting rule
Author:@razvialex
Description:Detect interesting files containing sfx with pdb paths.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptOne

Executable exe e601a9b4dc605b4e283a5b97ed2cb16da2e754b7a6c27585c6f0d1cdbed99094

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/332988/

Comments