MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f42553b4409992bbddc1df8b716596727762a191055cd2eebb3ced648cf5384f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f42553b4409992bbddc1df8b716596727762a191055cd2eebb3ced648cf5384f
SHA3-384 hash: ed782dfc6cd87d371a7fa4de29500e69f6fdf2682f159bd4d11c9c04390e1fc22dfb8d006d4d41508d7a6529de4e8a45
SHA1 hash: 38552111d3001f4998ab85408601873897653360
MD5 hash: 5e3189812e802c0fd68ce592cb1e1999
humanhash: single-red-equal-ack
File name:SecuriteInfo.com.W32.AIDetect.malware1.24453.7436
Download: download sample
Signature CryptBot
Create hunting rule
File size:749'568 bytes
First seen:2021-04-12 13:09:20 UTC
Last seen:2021-04-12 13:45:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cc8b588252cad91c39726b15504331a (1 x CryptBot)
ssdeep 12288:hDTY0MImKSz4jaZb47XE2DUNLgjgV5cWdoGAM3GDoaCBdBaMDKif2QhR2I:dNMIOz42qDEbBV5RJ26DKO2JI
TLSH 30F4020132D0C073C05364B6451DCBB14EAEB53156BAAA8F7BE80BBC5F697D1AB2531B
Reporter SecuriteInfoCom
Tags:CryptBot

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetect.malware1.24453.7436
Verdict:
Malicious activity
Analysis date:
2021-04-12 13:11:22 UTC
Tags:
stealer trojan loader
Link:
https://app.any.run/tasks/0355876a-9b1b-4694-aad6-2a62e698fb9b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/133758/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.24453.7436.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Deleting a recently created file
Creating a file
Delayed reading of the file
Reading critical registry keys
Creating a window
DNS request
Connection attempt
Sending an HTTP POST request
Sending a UDP request
Stealing user critical data
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Cryptbot Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/673040
Signature
Contains functionality to register a low level keyboard hook
Delayed program exit found
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Cryptbot
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 385467 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 12/04/2021 Architecture: WINDOWS Score: 100 70 EiodCJGkPupHarewIHgoYXhjJQvRZ.EiodCJGkPupHarewIHgoYXhjJQvRZ 2->70 78 Multi AV Scanner detection for domain / URL 2->78 80 Malicious sample detected (through community Yara rule) 2->80 82 Multi AV Scanner detection for dropped file 2->82 84 10 other signatures 2->84 10 SecuriteInfo.com.W32.AIDetect.malware1.24453.exe 50 2->10         started        15 SmartClock.exe 2->15         started        17 SmartClock.exe 2->17         started        signatures3 process4 dnsIp5 72 awumad01.top 8.209.66.205, 49719, 49720, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 10->72 74 mardeq01.top 8.209.64.179, 49718, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 10->74 76 aufsvg12.top 8.211.1.15, 49717, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 10->76 64 C:\Users\user\AppData\Local\Temp\Murano.exe, PE32 10->64 dropped 66 C:\Users\user\AppData\Local\...\lv[1].exe, PE32 10->66 dropped 90 Detected unpacking (changes PE section rights) 10->90 92 Detected unpacking (overwrites its own PE header) 10->92 94 Tries to harvest and steal browser information (history, passwords, etc) 10->94 19 Murano.exe 19 10->19         started        23 cmd.exe 1 10->23         started        file6 signatures7 process8 file9 58 C:\Users\user\AppData\Local\Temp\...\vpn.exe, PE32 19->58 dropped 60 C:\Users\user\AppData\Local\Temp\...\4.exe, PE32 19->60 dropped 62 C:\Users\user\AppData\Local\Temp\...\UAC.dll, PE32 19->62 dropped 86 Multi AV Scanner detection for dropped file 19->86 88 Machine Learning detection for dropped file 19->88 25 vpn.exe 7 19->25         started        27 4.exe 4 19->27         started        30 conhost.exe 23->30         started        32 timeout.exe 1 23->32         started        signatures10 process11 file12 34 makecab.exe 1 25->34         started        36 makecab.exe 1 25->36         started        38 makecab.exe 1 25->38         started        42 5 other processes 25->42 68 C:\Users\user\AppData\...\SmartClock.exe, PE32 27->68 dropped 40 SmartClock.exe 27->40         started        process13 process14 44 conhost.exe 34->44         started        46 conhost.exe 36->46         started        48 conhost.exe 38->48         started        50 conhost.exe 42->50         started        52 conhost.exe 42->52         started        54 conhost.exe 42->54         started        56 2 other processes 42->56
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f42553b4409992bbddc1df8b716596727762a191055cd2eebb3ced648cf5384f/
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-04-12 11:45:15 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6qsvhncatgjlxxob36fxczmwoj3wfimravonf3v3htwwjdhvhbhq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/210412-cspbbyv18j/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Runs ping.exe
Suspicious behavior: AddClipboardFormatListener
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Drops startup file
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Unpacked files
SH256 hash:
1c8aa27840154334812a12770ebd9c692902452dfc1ea10b6a0c3c3b32c9162a
MD5 hash:
df0d4b65092faac79e245e61a37fdf2b
SHA1 hash:
a0f2b45b28780654f4c71c189de8297a87abf26d
Link:
https://www.unpac.me/results/c82e318f-b25f-4f6a-a2db-90616189a212/
SH256 hash:
f42553b4409992bbddc1df8b716596727762a191055cd2eebb3ced648cf5384f
MD5 hash:
5e3189812e802c0fd68ce592cb1e1999
SHA1 hash:
38552111d3001f4998ab85408601873897653360
Link:
https://www.unpac.me/results/c82e318f-b25f-4f6a-a2db-90616189a212/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f42553b4409992bbddc1df8b716596727762a191055cd2eebb3ced648cf5384f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe f42553b4409992bbddc1df8b716596727762a191055cd2eebb3ced648cf5384f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/133758/
  
URLhaus
https://urlhaus.abuse.ch/url/1107223/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1107074/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-14 16:20:19 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0012.001] Anti-Static Analysis::Argument Obfuscation
1) [C0027.009] Cryptography Micro-objective::RC4::Encrypt Data
2) [C0021.004] Cryptography Micro-objective::RC4 PRGA::Generate Pseudo-random Sequence
3) [C0049] File System Micro-objective::Get File Attributes
4) [C0051] File System Micro-objective::Read File
5) [C0050] File System Micro-objective::Set File Attributes
6) [C0052] File System Micro-objective::Writes File
7) [C0033] Operating System Micro-objective::Console
8) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
9) [C0040] Process Micro-objective::Allocate Thread Local Storage
10) [C0041] Process Micro-objective::Set Thread Local Storage Value
11) [C0018] Process Micro-objective::Terminate Process