General

  • Target

    bae34b5431979a214eb8d112e79d305a8474eba7e46fb.exe

  • Size

    731KB

  • Sample

    210507-ksxhf5tqka

  • MD5

    7cae3416822ec2fa1a83a32d64f8f62d

  • SHA1

    64b02f9cd5ba4d407b470878abf6e20350eac4e1

  • SHA256

    bae34b5431979a214eb8d112e79d305a8474eba7e46fb7470adc48f82010e5b7

  • SHA512

    7e44467f071992b798b18cfc705eb4df89712b57af8f026dcc10a1d752f08d385f4e73a53546941b82343bcf50db5c53ffe72f6aa3927d0f110a826c9afa36e6

Malware Config

Extracted

Family

cryptbot

C2

eosbej52.top

morwxi05.top

Targets

    • Target

      bae34b5431979a214eb8d112e79d305a8474eba7e46fb.exe

    • Size

      731KB

    • MD5

      7cae3416822ec2fa1a83a32d64f8f62d

    • SHA1

      64b02f9cd5ba4d407b470878abf6e20350eac4e1

    • SHA256

      bae34b5431979a214eb8d112e79d305a8474eba7e46fb7470adc48f82010e5b7

    • SHA512

      7e44467f071992b798b18cfc705eb4df89712b57af8f026dcc10a1d752f08d385f4e73a53546941b82343bcf50db5c53ffe72f6aa3927d0f110a826c9afa36e6

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks