General

  • Target

    946a0aa660c43bb7e89ee62b4a214741ee6fa33c5d47cccde4842483d2e9e490

  • Size

    2MB

  • Sample

    220731-kr1tnsgha9

  • MD5

    b663be6e34606bdcf6f9037c087149d2

  • SHA1

    d54149390ba0b8c196772c2771a802bfaa980209

  • SHA256

    946a0aa660c43bb7e89ee62b4a214741ee6fa33c5d47cccde4842483d2e9e490

  • SHA512

    588e934a19f25ffee25ec2928332d2b575a02502e3f40414724e53bb0d414f0ad2affffec95929462b00bdbbd64332474c598ea88ac22a9d5bed0728629553f3

  • SSDEEP

    49152:yURBz01OdeAF79Xc/599Dm1p8JTKHKS8Fjm:yURBzgan9XcR7D881S8F

Malware Config

Extracted

Family

cryptbot

C2

myy01.top

Targets

    • Target

      946a0aa660c43bb7e89ee62b4a214741ee6fa33c5d47cccde4842483d2e9e490

    • Size

      2MB

    • MD5

      b663be6e34606bdcf6f9037c087149d2

    • SHA1

      d54149390ba0b8c196772c2771a802bfaa980209

    • SHA256

      946a0aa660c43bb7e89ee62b4a214741ee6fa33c5d47cccde4842483d2e9e490

    • SHA512

      588e934a19f25ffee25ec2928332d2b575a02502e3f40414724e53bb0d414f0ad2affffec95929462b00bdbbd64332474c598ea88ac22a9d5bed0728629553f3

    • SSDEEP

      49152:yURBz01OdeAF79Xc/599Dm1p8JTKHKS8Fjm:yURBzgan9XcR7D881S8F

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Persistence

                Privilege Escalation

                  Tasks