General

  • Target

    0bf3540ed99277014d8c86ba5dc3069159b265b94d757d6f8a59a22263446a13

  • Size

    634KB

  • Sample

    220213-kaymzshgdq

  • MD5

    fba9ec4b66ac4eb1c3148bf4138739d4

  • SHA1

    9392d88e85c0391c5d70eb3a2a9814c976b69fdb

  • SHA256

    0bf3540ed99277014d8c86ba5dc3069159b265b94d757d6f8a59a22263446a13

  • SHA512

    22f0320b80c5ddafc54a2c49add255d333dc53d4ee881bcb27861b9eb50aa2a74b474d635b74fd6ac95efa885599f3dbb88fdf5c6bdce7e077e934354a0c9b0a

Malware Config

Extracted

Family

cryptbot

C2

ewafve51.top

morexn05.top

Attributes
  • payload_url

    http://winorm07.top/download.php?file=lv.exe

Targets

    • Target

      0bf3540ed99277014d8c86ba5dc3069159b265b94d757d6f8a59a22263446a13

    • Size

      634KB

    • MD5

      fba9ec4b66ac4eb1c3148bf4138739d4

    • SHA1

      9392d88e85c0391c5d70eb3a2a9814c976b69fdb

    • SHA256

      0bf3540ed99277014d8c86ba5dc3069159b265b94d757d6f8a59a22263446a13

    • SHA512

      22f0320b80c5ddafc54a2c49add255d333dc53d4ee881bcb27861b9eb50aa2a74b474d635b74fd6ac95efa885599f3dbb88fdf5c6bdce7e077e934354a0c9b0a

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks