MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1d76f93fe7eee3f845d8b849054d5f268616734c10c941977c5b3e3017a295c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f1d76f93fe7eee3f845d8b849054d5f268616734c10c941977c5b3e3017a295c
SHA3-384 hash: 5fef82055be37975f47ae879b4823285706a81cb68d8989b3beafea6a67c4f7eb1b2579e2b75a07d81c01efb45bde076
SHA1 hash: 8bffd445519acabbee5fefc45f3d6710ef9cb8fc
MD5 hash: b8e6896a668b771a44216c86d6b80626
humanhash: minnesota-double-bravo-vermont
File name:library
Download: download sample
Signature CryptBot
Create hunting rule
File size:3'616'256 bytes
First seen:2022-10-24 08:33:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 645677c3e04c7c165dc0fe775d79d74e (1 x CryptBot)
ssdeep 49152:KxBZS8lNrXHTkE/RToUvF/lV0GyQaXq9vSetWpEyyt7O7Ps:Kx/lNr3TbekdV0Gy9X1eyUaT
Threatray 14'975 similar samples on MalwareBazaar
TLSH T1EAF59D0ADD755D669CB894BC20DFCB1395488A9A4331EC2E9C4CCD2AE86D35F3DA352C
TrID 38.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
26.3% (.EXE) Win32 Executable (generic) (4505/5/1)
11.8% (.EXE) OS/2 Executable (generic) (2029/13)
11.6% (.EXE) Generic Win/DOS Executable (2002/3)
11.6% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon b282a88e8eaab692 (26 x CryptBot, 2 x RedLineStealer)
Reporter JAMESWT_WT
Tags:CryptBot exe

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://kyredk12.top/gate.php https://threatfox.abuse.ch/ioc/916317/

Intelligence

File Origin
# of uploads :
1
# of downloads :
274
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
ficker
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2022-10-24 06:33:20 UTC
Tags:
installer loader evasion trojan ficker stealer vidar opendir
Link:
https://app.any.run/tasks/6c18be6d-5dc9-4362-94f4-1eb74a44658c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/323311/
Detection(s):
SecuriteInfo.com.Variant.Lazy.253883.18628.17686.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a process from a recently created file
Searching for analyzing tools
Searching for the window
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
HawkEye
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f0856cfd-dc43-4af9-bd2b-45f96b8982fa
Result
Threat name:
CryptbotV2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1096326
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found C&C like URL pattern
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Self deletion via cmd or bat file
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Yara detected CryptbotV2
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 728968 Sample: library.exe Startdate: 24/10/2022 Architecture: WINDOWS Score: 100 38 Snort IDS alert for network traffic 2->38 40 Antivirus / Scanner detection for submitted sample 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 6 other signatures 2->44 8 library.exe 73 2->8         started        process3 dnsIp4 34 kyredk12.top 87.251.79.91, 49706, 80 RISS-ASRU Russian Federation 8->34 36 suqyjb01.top 185.244.183.24, 49707, 80 BELCLOUDBG Russian Federation 8->36 32 C:\Users\user\AppData\Roaming\...\helmed.exe, PE32 8->32 dropped 52 Self deletion via cmd or bat file 8->52 13 cmd.exe 1 8->13         started        15 cmd.exe 1 8->15         started        file5 signatures6 process7 process8 17 helmed.exe 7 13->17         started        21 conhost.exe 13->21         started        23 conhost.exe 15->23         started        25 timeout.exe 1 15->25         started        file9 30 C:\Users\user\AppData\...\DpEditor.exe, PE32 17->30 dropped 46 Query firmware table information (likely to detect VMs) 17->46 48 Hides threads from debuggers 17->48 50 Tries to detect sandboxes / dynamic malware analysis system (registry check) 17->50 27 DpEditor.exe 17->27         started        signatures10 process11 signatures12 54 Query firmware table information (likely to detect VMs) 27->54 56 Hides threads from debuggers 27->56 58 Tries to detect sandboxes / dynamic malware analysis system (registry check) 27->58
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f1d76f93fe7eee3f845d8b849054d5f268616734c10c941977c5b3e3017a295c/
Threat name:
Win32.Backdoor.Androm
Create hunting rule
Status:
Malicious
First seen:
2022-10-24 09:17:03 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6hlw7e76p3xd7bc5rocjavgv6jugczzuyegjiglxywz6gal2ffoa._file
Verdict:
malicious
Similar samples:
059b97d2db52813056ebdb7d6ea2ca90f9a7b10d4813b919b2ea78408a6e1508
CryptBot
26f426fd4ff119e8830681f0692ff3b627f6c5a0d8905c2ca07b6b4298e07f95
CryptBot
29842f71bd503e86896ae4b274aa21a0eaa67144ad83e2df89072ea8e8458fd0
CryptBot
43f6ee2aa859ad45bdc8afa4c2ea1f31f1925bee9a9eb5c716eec9ffb5c88cb3
CryptBot
96cf18e2a423b74f89f810553f9b4ba3859bd2f71172facfc8911c6cf6221881
CryptBot
d6ec737d10afdaf38cafede9fde045dd3ce7bc72c6ee13df33e018f0e7149893
CryptBot
daf4c0820c45f6be84cf248504e10bfee063ea6fc8de3b397adaa6682e4bb610
CryptBot
f404a5d8e7a6622e073a2a596e728cb5be383baa2df71924d116db5ed2fa68ee
CryptBot
+ 14'965 additional samples on MalwareBazaar
Result
Malware family:
cryptbot
Create hunting rule
Score:
  10/10
Tags:
family:cryptbot discovery evasion spyware stealer themida trojan
Link:
https://tria.ge/reports/221024-kgf2hsfec4/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Maps connected drives based on registry
Checks BIOS information in registry
Checks computer location settings
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
CryptBot
Malware Config
C2 Extraction:
[<
Unpacked files
SH256 hash:
b04fc132b94ab934bb9ac017203d95204da50a8044cacc60c01be76b4fbceffd
MD5 hash:
fdc59fba33a6b1a93fb96e9d4376586b
SHA1 hash:
7eb90ebb1aa10499b98d72051ce66c6a7fbe7e68
Link:
https://www.unpac.me/results/59378b72-d1f7-4561-b658-962ce2403a3f/
SH256 hash:
f1d76f93fe7eee3f845d8b849054d5f268616734c10c941977c5b3e3017a295c
MD5 hash:
b8e6896a668b771a44216c86d6b80626
SHA1 hash:
8bffd445519acabbee5fefc45f3d6710ef9cb8fc
Link:
https://www.unpac.me/results/59378b72-d1f7-4561-b658-962ce2403a3f/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f1d76f93fe7e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f1d76f93fe7eee3f845d8b849054d5f268616734c10c941977c5b3e3017a295c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_References_SecTools
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many IR and analysis tools
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/323311/

Comments