General

  • Target

    71af238fbf3c5a3a2c2c3594f1ba8a32

  • Size

    2.5MB

  • Sample

    220116-k1l2waffer

  • MD5

    71af238fbf3c5a3a2c2c3594f1ba8a32

  • SHA1

    b9f49782704b14572985ca13b10842d3aa836ad0

  • SHA256

    3c320ddeb57b9d6240cbaab26104e906dfa04a10115a773355a2157013e991a8

  • SHA512

    fb12811297a22a71ead742dcde54357cf712c04ad690ed6103287f903592999fcde804357488e062fb8783a24394cc0ff23fa1ffbb9d15941e38873a75f59d7f

Malware Config

Extracted

Family

cryptbot

C2

kotehj62.top

Attributes
  • payload_url

    http://okadoc09.top/download.php?file=makeyr.exe

Targets

    • Target

      71af238fbf3c5a3a2c2c3594f1ba8a32

    • Size

      2.5MB

    • MD5

      71af238fbf3c5a3a2c2c3594f1ba8a32

    • SHA1

      b9f49782704b14572985ca13b10842d3aa836ad0

    • SHA256

      3c320ddeb57b9d6240cbaab26104e906dfa04a10115a773355a2157013e991a8

    • SHA512

      fb12811297a22a71ead742dcde54357cf712c04ad690ed6103287f903592999fcde804357488e062fb8783a24394cc0ff23fa1ffbb9d15941e38873a75f59d7f

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

5
T1082

Tasks