General

  • Target

    d1f4624131c6e460ad6249a971512fd05ef4570de165f117f6ee898fae23a67f

  • Size

    11.1MB

  • Sample

    220524-234s5sbaf2

  • MD5

    88a5924588e9489864b9cde196060d2d

  • SHA1

    23eda2eefd39b91bc3a2c008ca7e97dae8559e43

  • SHA256

    d1f4624131c6e460ad6249a971512fd05ef4570de165f117f6ee898fae23a67f

  • SHA512

    2922cc2448386445f535772c4d3835a320adafb8aef29c401f874a9ff638456863b9e4ee08256bb3ab30f11bc1ca0eb8d713d6f9289692d63eb738bf89c20729

Malware Config

Targets

    • Target

      d1f4624131c6e460ad6249a971512fd05ef4570de165f117f6ee898fae23a67f

    • Size

      11.1MB

    • MD5

      88a5924588e9489864b9cde196060d2d

    • SHA1

      23eda2eefd39b91bc3a2c008ca7e97dae8559e43

    • SHA256

      d1f4624131c6e460ad6249a971512fd05ef4570de165f117f6ee898fae23a67f

    • SHA512

      2922cc2448386445f535772c4d3835a320adafb8aef29c401f874a9ff638456863b9e4ee08256bb3ab30f11bc1ca0eb8d713d6f9289692d63eb738bf89c20729

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks