General

  • Target

    434539fc41f392ecb53666db507f5bee

  • Size

    1.4MB

  • Sample

    231225-3gr3wsgahj

  • MD5

    434539fc41f392ecb53666db507f5bee

  • SHA1

    3ef7ed9b12ff625658d1c3721f24dd26d47ccb40

  • SHA256

    e91738ed18d90f3f8215a44eada04973157e0e8d81e2164393dc87f1f6a22fbc

  • SHA512

    121609cececbd5ec61304e04dd2f7f1b0157ce9b5d732d374bafc664799382a49543c0c3ade9a3eafa471c7f77c303457d530e9de212e2829981a1863afd2331

  • SSDEEP

    24576:8Wd49H5HtfuamM4Bb1v5AgY3kuMMetBNY1Z4dySgekW/wCdZX/G8OQzoc7l:QHtmaohRAroBXd5gS/wH8Lzoc

Malware Config

Extracted

Family

cryptbot

C2

ewavmp35.top

morxeg03.top

Attributes
  • payload_url

    http://winxob04.top/download.php?file=lv.exe

Targets

    • Target

      434539fc41f392ecb53666db507f5bee

    • Size

      1.4MB

    • MD5

      434539fc41f392ecb53666db507f5bee

    • SHA1

      3ef7ed9b12ff625658d1c3721f24dd26d47ccb40

    • SHA256

      e91738ed18d90f3f8215a44eada04973157e0e8d81e2164393dc87f1f6a22fbc

    • SHA512

      121609cececbd5ec61304e04dd2f7f1b0157ce9b5d732d374bafc664799382a49543c0c3ade9a3eafa471c7f77c303457d530e9de212e2829981a1863afd2331

    • SSDEEP

      24576:8Wd49H5HtfuamM4Bb1v5AgY3kuMMetBNY1Z4dySgekW/wCdZX/G8OQzoc7l:QHtmaohRAroBXd5gS/wH8Lzoc

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks