General

  • Target

    f086aac3b541fd80290683eda414af10.exe

  • Size

    768KB

  • Sample

    210522-2sgecg5tfe

  • MD5

    f086aac3b541fd80290683eda414af10

  • SHA1

    16b402b8eade2b0b96a31294b891e3d4d71da3a0

  • SHA256

    8b8a48214f0d0d1a9e210e5f871cc5f608ccb48b6079ec4bcdd5538adbd8d8f2

  • SHA512

    192b3dd78ea297722a14ea6d12ba06a77a2d3841360abe743f29316a54caed487a065faba7bcb331068ab13768ecfa3957ebd658d0d13f6cb8ea52d2ffb86b6d

Malware Config

Extracted

Family

cryptbot

C2

soggdx52.top

moratr05.top

Attributes
  • payload_url

    http://douydw07.top/download.php?file=lv.exe

Targets

    • Target

      f086aac3b541fd80290683eda414af10.exe

    • Size

      768KB

    • MD5

      f086aac3b541fd80290683eda414af10

    • SHA1

      16b402b8eade2b0b96a31294b891e3d4d71da3a0

    • SHA256

      8b8a48214f0d0d1a9e210e5f871cc5f608ccb48b6079ec4bcdd5538adbd8d8f2

    • SHA512

      192b3dd78ea297722a14ea6d12ba06a77a2d3841360abe743f29316a54caed487a065faba7bcb331068ab13768ecfa3957ebd658d0d13f6cb8ea52d2ffb86b6d

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks