Overview

overview

10

Static

static

3

setupfile.exe

windows7-x64

10

setupfile.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    setupfile.exe

  • Size

    304MB

  • Sample

    230703-p4zjlahg5v

  • MD5

    c791dba7aca6e2be93d2d2cc092596ce

  • SHA1

    f669ea5bd172f06cb9590dd1a6d5d787fd5690a3

  • SHA256

    83330692f4b29fa638c5d3b39a3c7c01c6551df1f49da57b507ca81a4649b758

  • SHA512

    ca66c84dac07085bb1c3d8f066ac73a789f13c512216f69380d30c78f938907be1c76ce08822a959141a72608ebfe3adcf7e01cefebddec217833adc3d1d7a65

  • SSDEEP

    196608:tIxCTCcvjuk+IGhQ1i2MoJcXA0QvQaT0u5S:tkCTCcruk+RqQ2Vul6QaAu5S

Score
10/10
cryptbotspywarestealer

Malware Config

Extracted

Family

cryptbot

C2

http://olsylu55.top/gate.php

Targets

    • Target

      setupfile.exe

    • Size

      304MB

    • MD5

      c791dba7aca6e2be93d2d2cc092596ce

    • SHA1

      f669ea5bd172f06cb9590dd1a6d5d787fd5690a3

    • SHA256

      83330692f4b29fa638c5d3b39a3c7c01c6551df1f49da57b507ca81a4649b758

    • SHA512

      ca66c84dac07085bb1c3d8f066ac73a789f13c512216f69380d30c78f938907be1c76ce08822a959141a72608ebfe3adcf7e01cefebddec217833adc3d1d7a65

    • SSDEEP

      196608:tIxCTCcvjuk+IGhQ1i2MoJcXA0QvQaT0u5S:tkCTCcruk+RqQ2Vul6QaAu5S

    Score
    10/10
    cryptbotspywarestealer

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • Executes dropped EXE

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks