General

  • Target

    a99d5858ee5dc1f7e1a88717aae245e1.exe

  • Size

    663KB

  • Sample

    210501-lyznntwycn

  • MD5

    a99d5858ee5dc1f7e1a88717aae245e1

  • SHA1

    744d288e9f5b67e302688e47ac75fd959be3eee5

  • SHA256

    29e9301a2a4536910df563d965e6f7017786f229133c19b925216b0c056423b9

  • SHA512

    327b1a738fe4909dacb4cff4217b6d37fc33b2c7026d06bcdce30b6fc37dc413ef634d0616e7020f5c89a317f855a72e4e34b5ba1dfba9c26c59ca04de06c13e

Malware Config

Extracted

Family

cryptbot

C2

jusodd52.top

mortij05.top

Attributes
  • payload_url

    http://filiva07.top/download.php?file=lv.exe

Targets

    • Target

      a99d5858ee5dc1f7e1a88717aae245e1.exe

    • Size

      663KB

    • MD5

      a99d5858ee5dc1f7e1a88717aae245e1

    • SHA1

      744d288e9f5b67e302688e47ac75fd959be3eee5

    • SHA256

      29e9301a2a4536910df563d965e6f7017786f229133c19b925216b0c056423b9

    • SHA512

      327b1a738fe4909dacb4cff4217b6d37fc33b2c7026d06bcdce30b6fc37dc413ef634d0616e7020f5c89a317f855a72e4e34b5ba1dfba9c26c59ca04de06c13e

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks