General

  • Target

    e1d2efbb7c57651e87c324030e6a1c53f171e2f69a49c94556ae7ff63f7e864d

  • Size

    2.8MB

  • Sample

    220211-c24djsbebl

  • MD5

    e066ff0c7010232f1059d0398dc2c720

  • SHA1

    320d69f502460a590679e4ac35309df0f0707216

  • SHA256

    e1d2efbb7c57651e87c324030e6a1c53f171e2f69a49c94556ae7ff63f7e864d

  • SHA512

    852cf674c9ecd9586e9355a0558d97feec59669bee9270a1dcb7906976e13d9514afa0974ec2bcec9aa68d14b603f15b4f6b18d252720afba17eafcbe86cc88d

Malware Config

Extracted

Family

cryptbot

C2

zyoksv12.top

morlea01.top

Attributes
  • payload_url

    http://yapivt01.top/download.php?file=ainger.exe

Targets

    • Target

      e1d2efbb7c57651e87c324030e6a1c53f171e2f69a49c94556ae7ff63f7e864d

    • Size

      2.8MB

    • MD5

      e066ff0c7010232f1059d0398dc2c720

    • SHA1

      320d69f502460a590679e4ac35309df0f0707216

    • SHA256

      e1d2efbb7c57651e87c324030e6a1c53f171e2f69a49c94556ae7ff63f7e864d

    • SHA512

      852cf674c9ecd9586e9355a0558d97feec59669bee9270a1dcb7906976e13d9514afa0974ec2bcec9aa68d14b603f15b4f6b18d252720afba17eafcbe86cc88d

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

5
T1082

Tasks