MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 faa47da24f0494f637c0264a6d1d53f033a693c5bce624b8e9d4c525dd0e2e9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Crypt888


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: faa47da24f0494f637c0264a6d1d53f033a693c5bce624b8e9d4c525dd0e2e9f
SHA3-384 hash: b64bdf44795af6eae936845f02b6dfe9b4e91748d6a23323bf1774442643b66872fdde4910b2c684f96de0679c088a4a
SHA1 hash: 8d14cbd67c2b8a596cb2216f3fd64d881bd8f381
MD5 hash: c30b770ed4e60beb23972392af2be97e
humanhash: oscar-fix-angel-salami
File name:tmp41D8.tmp.exe
Download: download sample
Signature Crypt888
Create hunting rule
File size:900'570 bytes
First seen:2020-10-10 15:48:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d3bf8a7746a8d1ee8f6e5960c3f69378 (247 x Formbook, 75 x AgentTesla, 64 x SnakeKeylogger)
ssdeep 24576:oRmJkcoQricOIQxiZY1iaDFiBVauhrbD+:NJZoQrbTFZY1iaDFiBbhrbi
Threatray 172 similar samples on MalwareBazaar
TLSH CA15B021F5C68036C2B327B19E7FF76A963D69360326D29727C82D317EA05416B39723
Reporter vm001cn
Tags:Crypt888 exe Ransomware RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
332
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Reading critical registry keys
Creating a file
Sending a UDP request
Creating a file in the %AppData% directory
Changing a file
Creating a file in the %temp% directory
Deleting a recently created file
Stealing user critical data
Forced shutdown of a browser
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.spyw
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/487534
Signature
Antivirus / Scanner detection for submitted sample
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for submitted file
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/faa47da24f0494f637c0264a6d1d53f033a693c5bce624b8e9d4c525dd0e2e9f/
Threat name:
Win32.Ransomware.Pocrimcrypt
Create hunting rule
Status:
Malicious
First seen:
2020-09-29 09:53:01 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ksh3ispaskpmn6aezfg2hkt6az2ne6fxttcjohj2tcslxiof2pq._file
Verdict:
malicious
Similar samples:
38e5fde6988bbf02467d7b59ba15a3dfbdaedfab4804c60cf3ae44db6b48a844
Crypt888
62e2d0479075cb28a37635972b9d3ad111e77b86b70de000409e11fe3f1d025a
Crypt888
647260f08017b3f63e2c5178e751b9d37503850cc18aeaa367506e7808b1e249
Crypt888
6c5e170ec02d30c57a8bbceb8533eb73efd7b46f8ae1cd6e552fa6a5656afb36
Crypt888
83b924a12b9d879758a2cd4c73a095de0ba4016163f76c94404820e741534030
Crypt888
8a72a55d126b69bda2f37fd88050aeed02d97733f6777759b542db8a442435bc
Crypt888
9129967bfcf44c87ec6eb83a30f5500a5e453c76281b7ec3b0c1caa778377e08
Crypt888
aff4652e2ee285a5ad71717a36e215c1eb59787d74e73a763701b0a5f68751a7
Crypt888
ed105272dc3c77f54e7d170474afa6590a98477e6b076d7e5d1cf6c5e152319d
Crypt888
fb400e7c4b16ab67fa5c080f8b1e7f7db965b77d097526a6a28ef5ca34f24bd9
Crypt888
+ 162 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
spyware ransomware
Link:
https://tria.ge/reports/201010-jbxy1a2bj2/
Behaviour
Modifies Control Panel
Suspicious behavior: EnumeratesProcesses
Enumerates system info in registry
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Sets desktop wallpaper using registry
Enumerates connected drives
JavaScript code in executable
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
faa47da24f0494f637c0264a6d1d53f033a693c5bce624b8e9d4c525dd0e2e9f
MD5 hash:
c30b770ed4e60beb23972392af2be97e
SHA1 hash:
8d14cbd67c2b8a596cb2216f3fd64d881bd8f381
Link:
https://www.unpac.me/results/b5372882-d9d3-4cb2-9387-a209dbf397dc/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Cryptolocker
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/faa47da24f0494f637c0264a6d1d53f033a693c5bce624b8e9d4c525dd0e2e9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AutoIT_Compiled
Create hunting rule
Author:@bartblaze
Description:Identifies compiled AutoIT script (as EXE).

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/69752/

Comments