cryptbot

General

Target

5f0f316459cf8e92f8705124acdbe3e4
Size

746KB
Sample

210727-e3f6wr6g1n
MD5

5f0f316459cf8e92f8705124acdbe3e4
SHA1

dd8ec58e0fb787491eae153bd02d3be825fa8f3a
SHA256

b118e2deb33dc46a4ae01ba586feafcae96251267ab36dee8aa7f282b7263d13
SHA512

5af5e66c8de74c941337d44315beb9ded9bf9ada0b8348820c87516ef5eb507ab44586afc7401d72e61b829d1bc2e87034cfe82eaf4353a3772653c4677854c4

Score

10^/10

cryptbot danabot 4 banker discovery persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

cryptbot

C2

ewapyc22.top

morzup02.top

Attributes

payload_url
http://winqoz02.top/download.php?file=lv.exe

Extracted

Family

danabot

Version

1987

Botnet

4

C2

142.11.244.124:443

142.11.206.50:443

Attributes

embedded_hash
6AD9FE4F9E491E785665E0D144F61DAB

rsa_privkey.plain

rsa_pubkey.plain

Targets

- Target
  
  5f0f316459cf8e92f8705124acdbe3e4
- Size
  
  746KB
- MD5
  
  5f0f316459cf8e92f8705124acdbe3e4
- SHA1
  
  dd8ec58e0fb787491eae153bd02d3be825fa8f3a
- SHA256
  
  b118e2deb33dc46a4ae01ba586feafcae96251267ab36dee8aa7f282b7263d13
- SHA512
  
  5af5e66c8de74c941337d44315beb9ded9bf9ada0b8348820c87516ef5eb507ab44586afc7401d72e61b829d1bc2e87034cfe82eaf4353a3772653c4677854c4
Score

10^/10

cryptbot spyware stealer danabot 4 banker discovery persistence suricata trojan
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- CryptBot Payload
- Danabot
  Danabot is a modular banking Trojan that has been linked with other malware.
  trojan banker danabot
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2