MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eaef807dc7cdfd704cf47b74a667b55004de9171fdb8b949c451274569549d41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eaef807dc7cdfd704cf47b74a667b55004de9171fdb8b949c451274569549d41
SHA3-384 hash: a4cdc69c1b75a5514c6af85a4c75c82feb0c94a1485ba624354df6b434b0b096c7223d1c43a11c5661dd326abc6f9768
SHA1 hash: dc54547642e7f514855ca1afd40a58a8377975af
MD5 hash: 8a1baccbc8382a7eca8c99ee981f6776
humanhash: magazine-moon-mobile-black
File name:8a1baccbc8382a7eca8c99ee981f6776.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:2'880'000 bytes
First seen:2021-12-23 08:49:28 UTC
Last seen:2021-12-23 11:07:12 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 497bb8e047f00ee41c710ddd37634657 (7 x CryptBot)
ssdeep 49152:+x6H2aqLLwBIMI0exB+U13Ge3MiU92XG0wRLa8tPDUogx8meYa3PoK4L:+8HLq4BI4eAe8D4GNRrPDUog8Bf3PoK4
Threatray 8'412 similar samples on MalwareBazaar
TLSH T145D5335DEFABCCD2E0C956362402105C9B376D50CB7944D85F3F34FA5EBA899838AB60
Reporter abuse_ch
Tags:CryptBot exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8a1baccbc8382a7eca8c99ee981f6776.exe
Verdict:
Malicious activity
Analysis date:
2021-12-23 08:58:12 UTC
Tags:
stealer trojan
Link:
https://app.any.run/tasks/dcda782e-55fb-40a6-b294-d75baf1a421e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/215923/
Detection(s):
SecuriteInfo.com.Variant.Zusy.399076.10967.6232.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
DNS request
Sending an HTTP POST request
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Result
Malware family:
n/a
Score:
  0/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2993/overview
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61c43840ec6c6c14a9ec1703/reports/bcbb21ba-1c18-44ac-817c-fb96834c33f9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/670ccdd8-6a0a-40be-9c5a-2fae5b53f075
Result
Threat name:
Cryptbot
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/911930
Signature
Antivirus / Scanner detection for submitted sample
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Self deletion via cmd delete
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Cryptbot
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eaef807dc7cdfd704cf47b74a667b55004de9171fdb8b949c451274569549d41/
Threat name:
Win32.Trojan.SelfDel
Create hunting rule
Status:
Malicious
First seen:
2021-12-23 08:50:18 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
3836136ddb7cfa2fc48e44c6b385da79df47380445f4c4fdaf552cf0aeb09816
CryptBot
40aa6aeab7d3af11f53ddda96690c31e5b5619c4c0b1791a62f5121c65c4ad0d
CryptBot
5794e9722cdb1ec697ee0ae9fe5464fb9e85ba3157485d6ecb9cea44455cf37a
CryptBot
73842595c824b3ed06e5e975c9fb247012ea58dba4facc6c1ecb1c7608b30032
CryptBot
8f983b92dea0643ef2b8411e5506def0c0235b1addd4daa9d13e59ff4f88a1ef
CryptBot
acda9ae5a6c865eb3291e1bb7cc41e6b0f86a12e180c984a2f4fcb302505021b
CryptBot
ad7a74ddae7cc81d8610ab6bedb94857f38c03b795c4a612fbacc47941286709
CryptBot
c6aa02a56f11f479f9ae81a74af6cdf1fd8a13ab88e569aa01ab37604bbfc313
CryptBot
d565f4380b4f2d25673f08df8e88d331e0daf7946a73c83e8d1630e2b347ddf9
CryptBot
e13fb6156b386d9cea3a46c3835a97636ad0eeddda3b354f86f19915721638fc
CryptBot
+ 8'402 additional samples on MalwareBazaar
Result
Malware family:
cryptbot
Create hunting rule
Score:
  10/10
Tags:
family:cryptbot discovery evasion spyware stealer themida trojan
Link:
https://tria.ge/reports/211223-krl1hshdc8/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Deletes itself
Reads user/profile data of web browsers
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
CryptBot
Malware Config
C2 Extraction:
놱 ≺�￿l骗 }仟炨lꛏ᫸ R2^�턅l叽迢
缊2対ᦦ࢑ ݦR䲟}얍䦙놱 ≺�￿l骗 }仟炨lꛏ᫸ R2^�턅l叽迢
dainfe42.top
morvtu04.top
Unpacked files
SH256 hash:
52f1e282953c1411cf3c5761156d81bb3321525c632d2b59080788f43699a5f1
MD5 hash:
78f94d2f763846669fe9920e3fce4f51
SHA1 hash:
4e53deefac2c19c8660eb061d617b03b55efb31f
Link:
https://www.unpac.me/results/62652ffb-76eb-4c88-ba4f-83cdcbf1542d/
SH256 hash:
eaef807dc7cdfd704cf47b74a667b55004de9171fdb8b949c451274569549d41
MD5 hash:
8a1baccbc8382a7eca8c99ee981f6776
SHA1 hash:
dc54547642e7f514855ca1afd40a58a8377975af
Link:
https://www.unpac.me/results/62652ffb-76eb-4c88-ba4f-83cdcbf1542d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/eaef807dc7cdfd704cf47b74a667b55004de9171fdb8b949c451274569549d41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe eaef807dc7cdfd704cf47b74a667b55004de9171fdb8b949c451274569549d41

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/215923/
  
URLhaus
https://urlhaus.abuse.ch/url/1911281/
  
Delivery method
Distributed via web download

Comments