General
-
Target
dba20ac697952657e4daee957e10a805.exe
-
Size
352KB
-
Sample
210519-wvsghgy2en
-
MD5
dba20ac697952657e4daee957e10a805
-
SHA1
977ce4fa46cbb90c42b98ee493e6942da44d4a20
-
SHA256
fb5d2b6d9ec1b9c07e64f6b9eb148099f0b43d58dc867102c02b16a9a9152022
-
SHA512
38f0c4e6fcda9a5c9615744c31d9854c99cc2dd2a04b5d2ad79e3f3b39a8fedd7c7e14af29df63b193bff7837f86447f2627d1a6c21fccd07cdccbfe68aad647
Static task
static1
Behavioral task
behavioral1
Sample
dba20ac697952657e4daee957e10a805.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
dba20ac697952657e4daee957e10a805.exe
Resource
win10v20210408
Malware Config
Extracted
raccoon
7528117f6a744f7afc4b767f2029d96b378f12c8
-
url4cnc
https://telete.in/capibar
Extracted
cryptbot
sogkfl32.top
moraug03.top
-
payload_url
http://doufvh04.top/download.php?file=lv.exe
Targets
-
-
Target
dba20ac697952657e4daee957e10a805.exe
-
Size
352KB
-
MD5
dba20ac697952657e4daee957e10a805
-
SHA1
977ce4fa46cbb90c42b98ee493e6942da44d4a20
-
SHA256
fb5d2b6d9ec1b9c07e64f6b9eb148099f0b43d58dc867102c02b16a9a9152022
-
SHA512
38f0c4e6fcda9a5c9615744c31d9854c99cc2dd2a04b5d2ad79e3f3b39a8fedd7c7e14af29df63b193bff7837f86447f2627d1a6c21fccd07cdccbfe68aad647
-
CryptBot Payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-