Overview

overview

10

Static

static

9f9b4a29bf...68.exe

windows7_x64

10

9f9b4a29bf...68.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9f9b4a29bff765b3a6c79737f4471268.exe

  • Size

    698KB

  • Sample

    220224-wrfz2segbq

  • MD5

    9f9b4a29bff765b3a6c79737f4471268

  • SHA1

    ac6dd5c92e07bf2057dacf5b15cace59b2d0f88e

  • SHA256

    161ce807aa141a328eeb24bdc91264071ab2dddf6184c974dabf86ad91b0a77e

  • SHA512

    67c83d686ca2da124877fbb31e953be80363ecf27e0dc29093f3bf6259b2ca41800223b23a8d13b87f1d8df6fe9d47ada6748be8cdaff602cffa0a8461d487bb

Score
10/10
cryptbotspywarestealer

Malware Config

Extracted

Family

cryptbot

C2

brikwl42.top

Targets

    • Target

      9f9b4a29bff765b3a6c79737f4471268.exe

    • Size

      698KB

    • MD5

      9f9b4a29bff765b3a6c79737f4471268

    • SHA1

      ac6dd5c92e07bf2057dacf5b15cace59b2d0f88e

    • SHA256

      161ce807aa141a328eeb24bdc91264071ab2dddf6184c974dabf86ad91b0a77e

    • SHA512

      67c83d686ca2da124877fbb31e953be80363ecf27e0dc29093f3bf6259b2ca41800223b23a8d13b87f1d8df6fe9d47ada6748be8cdaff602cffa0a8461d487bb

    Score
    10/10
    cryptbotspywarestealer

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks