General

  • Target

    0bb6063bcaca554ed28aa896f43e918e3d702947ee482a40f6420f045a749f9b

  • Size

    4.2MB

  • Sample

    220530-cqsgxaadh7

  • MD5

    0d31b31b5d6c148c3dd0c81f98054ec2

  • SHA1

    8af6c640646b5f96e3f4f01abe2b76b625e3ca16

  • SHA256

    0bb6063bcaca554ed28aa896f43e918e3d702947ee482a40f6420f045a749f9b

  • SHA512

    160baa13fcaba22b815923e591b182903cfa1b1b3e3603724e6e47ec66276f11c0eec27a27b924ebcdaa81bc27812c7f5d88ba239d55379f13456cc48e5ae42f

Malware Config

Targets

    • Target

      0bb6063bcaca554ed28aa896f43e918e3d702947ee482a40f6420f045a749f9b

    • Size

      4.2MB

    • MD5

      0d31b31b5d6c148c3dd0c81f98054ec2

    • SHA1

      8af6c640646b5f96e3f4f01abe2b76b625e3ca16

    • SHA256

      0bb6063bcaca554ed28aa896f43e918e3d702947ee482a40f6420f045a749f9b

    • SHA512

      160baa13fcaba22b815923e591b182903cfa1b1b3e3603724e6e47ec66276f11c0eec27a27b924ebcdaa81bc27812c7f5d88ba239d55379f13456cc48e5ae42f

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks