General

  • Target

    2d42689f68d15b4c7cadf603a64ac14a1c2a0bc87f5989153285e2a28890c632

  • Size

    1.5MB

  • Sample

    220614-yq3hrsegh9

  • MD5

    32f01cd28b26cae65fc3f505443aeaed

  • SHA1

    48c0f196cf78596181a40755d6b724908e1c05f4

  • SHA256

    2d42689f68d15b4c7cadf603a64ac14a1c2a0bc87f5989153285e2a28890c632

  • SHA512

    37ac4d19fd12a9185c5e8cf4a03a184c253b527b8a6148922e1aa69bd3f8b188566649dd6ce89d35cc6634ec2391beba4e9ad9d26d30960e80faa94c62d232d8

Malware Config

Extracted

Family

cryptbot

C2

eresseds57.top

eressedy23.top

Attributes
  • payload_url

    http://dowhhaz12.top/download.php?file=lv.exe

Targets

    • Target

      2d42689f68d15b4c7cadf603a64ac14a1c2a0bc87f5989153285e2a28890c632

    • Size

      1.5MB

    • MD5

      32f01cd28b26cae65fc3f505443aeaed

    • SHA1

      48c0f196cf78596181a40755d6b724908e1c05f4

    • SHA256

      2d42689f68d15b4c7cadf603a64ac14a1c2a0bc87f5989153285e2a28890c632

    • SHA512

      37ac4d19fd12a9185c5e8cf4a03a184c253b527b8a6148922e1aa69bd3f8b188566649dd6ce89d35cc6634ec2391beba4e9ad9d26d30960e80faa94c62d232d8

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot Payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks