MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5587865ccceec4fe4fc1436d78ffebc33d30b656f061097b77af4a766d60d22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptBot


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5587865ccceec4fe4fc1436d78ffebc33d30b656f061097b77af4a766d60d22
SHA3-384 hash: b56ed22debed8f7e163670e6096d494180040f39dd86854885f190701226d8333186bb6493460cb4286ba0686d5937e0
SHA1 hash: c9d042994e8d2cbb7301698465413d5f34c64d14
MD5 hash: 2bd9bf4a34f667ce365d5c36ee8a6962
humanhash: bakerloo-cardinal-hydrogen-alabama
File name:2bd9bf4a34f667ce365d5c36ee8a6962.exe
Download: download sample
Signature CryptBot
Create hunting rule
File size:628'224 bytes
First seen:2021-07-20 19:16:45 UTC
Last seen:2021-07-20 20:15:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 055a132f816caf77140419827eb35d9b (1 x Glupteba, 1 x CryptBot, 1 x RaccoonStealer)
ssdeep 12288:B7WnPKG3lAflVda5IjUoLZlGGNVIL9ca6MexktURjPKnHy:BqPKssIIv9lG8k9czet7y
Threatray 257 similar samples on MalwareBazaar
TLSH T16AD4122034E6C573E5F64A3068F6D2906F3FB8329866860B765437CA5B736C25B7C392
Reporter abuse_ch
Tags:CryptBot exe


Avatar
abuse_ch
CryptBot C2:
http://moryuf02.top/index.php

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://moryuf02.top/index.php https://threatfox.abuse.ch/ioc/161771/

Intelligence

File Origin
# of uploads :
2
# of downloads :
167
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2bd9bf4a34f667ce365d5c36ee8a6962.exe
Verdict:
Malicious activity
Analysis date:
2021-07-20 19:20:10 UTC
Tags:
stealer trojan
Link:
https://app.any.run/tasks/3785b883-601f-4ac6-a5fa-fcb75c235d42

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
CryptBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/172891/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.10122.28743.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
CryptBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ddf53ba5-a43c-4180-912f-203ef90c7caf
Result
Threat name:
Cryptbot Glupteba
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/819200
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Cryptbot
Yara detected Glupteba
Behaviour
Behavior Graph:
Download SVG
Detection:
cryptbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/f5587865ccceec4fe4fc1436d78ffebc33d30b656f061097b77af4a766d60d22/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-07-20 19:17:05 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6vmhqzomz3we7zh4cq3npd76xqz5gc3fn4dbbf5xpl2kozwwbura._file
Verdict:
malicious
Similar samples:
12dcd1bdd0cae0600249bccca37eb78756f4bec7b9e98d857eb33251b6f357fe
CryptBot
164f6dd9a77be0fc7425a9f97873435bdade7dc85da44c27474d2187395dfac6
CryptBot
2e150d7c07b1e33fec7acafa7c4d556c01ae2a8b41d67a80996bda3e71a312dd
CryptBot
3019cbb993e1bbf087a7aaeed07ddf5625ba6d15f28b2120af7d661c42cc7625
CryptBot
36b09f53de4010616ddd1a8f4cbb9b1a1e87b655b10b406653380b77324956c7
CryptBot
3f73237acdf89666712734296663edda4c5f7f7ca9271313e4dd94291dc5b531
CryptBot
530656ad87a4e5c0f07998323ebca34348af7c7a2e585196f2d0c73580832e36
CryptBot
6c2f740758b9e93bb0f3a30b16f6aa154dcb3f6011455f01190c9299d9b8beef
CryptBot
a2ed4456865129f69ed876a3262526d1193bc881708d46d86be1528f23c1b749
CryptBot
abaaec80f4b0d2fccb5b2c09869a9f86628b987f7369abefce67108dd1982595
CryptBot
+ 247 additional samples on MalwareBazaar
Result
Malware family:
cryptbot
Create hunting rule
Score:
  10/10
Tags:
family:cryptbot discovery spyware stealer
Link:
https://tria.ge/reports/210720-4q3hb488l2/
Behaviour
Checks processor information in registry
Delays execution with timeout.exe
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of web browsers
CryptBot
CryptBot Payload
Malware Config
C2 Extraction:
smatau22.top
moryuf02.top
Unpacked files
SH256 hash:
0254754800e3725388113a97d12884e93982c961ca6ecb6c682a5149afe5c9a3
MD5 hash:
ffc4ba7d2c185d6db141818298a7b39c
SHA1 hash:
f4c191f5e25396478a5025127de841e9478d850b
Link:
https://www.unpac.me/results/3aca4604-9db4-45c6-94a2-8ee6a3134d01/
SH256 hash:
f5587865ccceec4fe4fc1436d78ffebc33d30b656f061097b77af4a766d60d22
MD5 hash:
2bd9bf4a34f667ce365d5c36ee8a6962
SHA1 hash:
c9d042994e8d2cbb7301698465413d5f34c64d14
Link:
https://www.unpac.me/results/3aca4604-9db4-45c6-94a2-8ee6a3134d01/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f5587865ccceec4fe4fc1436d78ffebc33d30b656f061097b77af4a766d60d22

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:MALWARE_Win_CryptBot
Create hunting rule
Author:ditekSHen
Description:CryptBot/Fugrafa stealer payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptBot

Executable exe f5587865ccceec4fe4fc1436d78ffebc33d30b656f061097b77af4a766d60d22

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1466477/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/172891/

Comments