MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5b89abfe105466c052dc8458a33028fb0304b6a55fb4ceaa332dbbe4add925f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


CryptOne


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f5b89abfe105466c052dc8458a33028fb0304b6a55fb4ceaa332dbbe4add925f
SHA3-384 hash: cf4980f785ece968a1e9a6f4d188840a169ea3accde440863094bbd968f136c6a62f1cbbad69b3c105f481893a241551
SHA1 hash: f6c1c124c0d0899225e6802bf6427e7f61ae6186
MD5 hash: 7122b8bfc1945f6b0c5a0492df204e50
humanhash: oranges-monkey-oven-pennsylvania
File name:7122b8bfc1945f6b0c5a0492df204e50.exe
Download: download sample
Signature CryptOne
Create hunting rule
File size:2'087'842 bytes
First seen:2022-11-16 18:09:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat)
ssdeep 49152:F0BfJXAEhytxZVzOywtEv1pwFbFVjpu6z/CwmFiksvW4kLAEwWvaWKjoelINq/:F0BfKEhYxnOywtEv1pwFs93FiFHkL3lY
Threatray 2'600 similar samples on MalwareBazaar
TLSH T1E2A52305FF868A72C9A30A3106292715513CBCB11E29DB5BE7D06D2F97B41C16922FFB
TrID 88.3% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
4.7% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.0% (.EXE) Win32 Executable (generic) (4505/5/1)
0.9% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon b3b3b371716b93b3 (25 x CryptOne, 12 x RemcosRAT, 6 x RedLineStealer)
Reporter abuse_ch
Tags:CryptOne exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7122b8bfc1945f6b0c5a0492df204e50.exe
Verdict:
Malicious activity
Analysis date:
2022-11-16 18:18:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/509927f9-6376-48a4-8419-c3e0e0da776a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/334999/
Detection(s):
SecuriteInfo.com.Trojan.Uztuby.4.29290.7140.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Launching a process
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed setupapi.dll shdocvw.dll shell32.dll
Link:
https://www.filescan.io/uploads/6375277a65b4ed3de8c86f93/reports/b4ad6223-04d9-4b2e-8797-9ea88f0ca09c/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/9ae479f2-7bd6-48b2-8c72-ce08630270f5
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1115165
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 747868 Sample: yuMHcz1oCC.exe Startdate: 16/11/2022 Architecture: WINDOWS Score: 88 22 Antivirus detection for dropped file 2->22 24 Antivirus / Scanner detection for submitted sample 2->24 26 Multi AV Scanner detection for dropped file 2->26 28 4 other signatures 2->28 9 yuMHcz1oCC.exe 3 8 2->9         started        process3 file4 20 C:\Users\user\AppData\Local\...\~jv4yLB3.cpl, PE32 9->20 dropped 12 control.exe 1 9->12         started        process5 process6 14 rundll32.exe 12->14         started        process7 16 rundll32.exe 14->16         started        process8 18 rundll32.exe 16->18         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f5b89abfe105466c052dc8458a33028fb0304b6a55fb4ceaa332dbbe4add925f/
Threat name:
Win32.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-11-16 10:28:17 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6w4jvp7bavdgybjnzbcyumycr6ydas3kkx5uz2vdgln34sw5sjpq._file
Verdict:
malicious
Similar samples:
280c314b18ddf2481c1173c653acf508262e0ad3dbf2dfa8b64f48d75bd10765
CryptOne
4618fb57958c19496e668916d769cb40e6bb0a0af0fbb1ff73ee89e701f3fe9b
CryptOne
7a6c916427ad4b4693f276085914313efc50a9b2716428bb644a35df82461126
CryptOne
af64f5b2b6c4cc63b0ca4bb48f369eba1629886d85e289a469a5c9612c4a5ee3
CryptOne
b1f692dd52aae8317db7cfd262a4bcc053cf721fc7a00bf66f4acc7cb5cc6cbc
CryptOne
b2a324897aebabb250e405cf19388be6979b40615b16b7b7d816c44ca90ec3fe
CryptOne
bea445cd71f0615353625114161291b7b9cab80829b3670951252053c72e68d4
CryptOne
d15e506977055556f490656e5abddb4c774ed22f58d7fa6ec6523e0148911408
CryptOne
df59ccb9d70f7f61dc2c65faa61446278fb402b64401f2f3cfe8bbad72f70610
CryptOne
+ 2'590 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/221116-wr2azsgc6w/
Behaviour
Modifies registry class
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a2d59ce4-21bc-4182-bb54-f0c12fc3d84b
Unpacked files
SH256 hash:
ba247e087393e724b3368becd02be21936bd964f85fd0892574f662fd671c648
MD5 hash:
8efb146ecbb57a88735418ac589ba569
SHA1 hash:
c9fd6c19b9fccf3f75fe998aba3e2343b95ec180
Link:
https://www.unpac.me/results/3ee78826-5b6d-4dfd-bd26-4d2e4fded24d/
SH256 hash:
64671455886c920c921deb4104b4d45ddb66caa595211611ec51698343b66c82
MD5 hash:
a9bb238513ba65cded524004c23d7458
SHA1 hash:
b35d133fa08fa0d37d9754c7c567cf556f2a40fb
Link:
https://www.unpac.me/results/3ee78826-5b6d-4dfd-bd26-4d2e4fded24d/
SH256 hash:
f5b89abfe105466c052dc8458a33028fb0304b6a55fb4ceaa332dbbe4add925f
MD5 hash:
7122b8bfc1945f6b0c5a0492df204e50
SHA1 hash:
f6c1c124c0d0899225e6802bf6427e7f61ae6186
Link:
https://www.unpac.me/results/3ee78826-5b6d-4dfd-bd26-4d2e4fded24d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f5b89abfe105466c052dc8458a33028fb0304b6a55fb4ceaa332dbbe4add925f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

CryptOne

Executable exe f5b89abfe105466c052dc8458a33028fb0304b6a55fb4ceaa332dbbe4add925f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/334999/
  
URLhaus
https://urlhaus.abuse.ch/url/2412573/
  
Delivery method
Distributed via web download

Comments