General
-
Target
SecuriteInfo.com.Troj.Kryptik-TR.16136.15513
-
Size
772KB
-
Sample
210610-nmy391dska
-
MD5
229903595a55a697324606e02ff2aa12
-
SHA1
7ee8fae04fd9a0e7bd2fefbe4e8be8fb1502e01c
-
SHA256
4fc37a3bc71ca1d695614e44a9867b13ae3ec30c0f0434dc2cf797772705b34e
-
SHA512
e19684fb25468b23cc74a3c34d49a0707b82c63b1e450e1f0ddb5aa1ddca286e2223538ac8099f18001d09c2746d9942cbf1b35d4c19c414f638656b596a6463
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Troj.Kryptik-TR.16136.15513.exe
Resource
win7v20210408
Malware Config
Extracted
cryptbot
olmyad42.top
morsen04.top
-
payload_url
http://vamcrq06.top/download.php?file=lv.exe
Extracted
danabot
1827
3
192.210.198.12:443
37.220.31.50:443
184.95.51.183:443
184.95.51.175:443
-
embedded_hash
410EB249B3A3D8613B29638D583F7193
Targets
-
-
Target
SecuriteInfo.com.Troj.Kryptik-TR.16136.15513
-
Size
772KB
-
MD5
229903595a55a697324606e02ff2aa12
-
SHA1
7ee8fae04fd9a0e7bd2fefbe4e8be8fb1502e01c
-
SHA256
4fc37a3bc71ca1d695614e44a9867b13ae3ec30c0f0434dc2cf797772705b34e
-
SHA512
e19684fb25468b23cc74a3c34d49a0707b82c63b1e450e1f0ddb5aa1ddca286e2223538ac8099f18001d09c2746d9942cbf1b35d4c19c414f638656b596a6463
-
CryptBot Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-