cryptbot

General

Target

141f2f0295414b069c74a1be852a05f1
Size

2.5MB
Sample

231230-k397gsfaek
MD5

141f2f0295414b069c74a1be852a05f1
SHA1

4f397e56fd9fcc37d8fef315e4949adb90ff8e17
SHA256

186992db0748857e13271f18b519fbf2b6f016bd8d81c3ee952786de798a6dad
SHA512

3660b00e58ae6400b4754873dd7049f7ed63b8dcb8d48e217d874e1d3abf47d0c229653c90a6b60571f5464a2f6a08ebd5a1746be8b7c2f0047d52cd8a6dcf47
SSDEEP

49152:9g1zPYCrGa7uHLbUlfL2hS2oXlBusU6qz0JJK/70x6ajn42BuLsJcyLUHJ:yxYCrGjjSB1y6hE/70AWnvwsJkJ

Score

10^/10

Malware Config

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

cryptbot

C2

lysoip68.top

morwaf06.top

Attributes

payload_url
http://damliq08.top/download.php?file=lv.exe

Extracted

Family

redline

Botnet

test1

C2

185.215.113.15:61506

Extracted

Family

vidar

Version

40

Botnet

706

C2

https://lenak513.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Targets

- Target
  
  141f2f0295414b069c74a1be852a05f1
- Size
  
  2.5MB
- MD5
  
  141f2f0295414b069c74a1be852a05f1
- SHA1
  
  4f397e56fd9fcc37d8fef315e4949adb90ff8e17
- SHA256
  
  186992db0748857e13271f18b519fbf2b6f016bd8d81c3ee952786de798a6dad
- SHA512
  
  3660b00e58ae6400b4754873dd7049f7ed63b8dcb8d48e217d874e1d3abf47d0c229653c90a6b60571f5464a2f6a08ebd5a1746be8b7c2f0047d52cd8a6dcf47
- SSDEEP
  
  49152:9g1zPYCrGa7uHLbUlfL2hS2oXlBusU6qz0JJK/70x6ajn42BuLsJcyLUHJ:yxYCrGjjSB1y6hE/70AWnvwsJkJ
Score

10^/10

cryptbot nullmixer privateloader redline sectoprat smokeloader vidar 706 pub5 test1 aspackv2 backdoor dropper infostealer loader rat spyware stealer trojan
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- CryptBot payload
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

CryptBot payload

NullMixer

PrivateLoader

RedLine

RedLine payload

SectopRAT

SectopRAT payload

SmokeLoader

Vidar

Vidar Stealer

ASPack v2.12-2.42

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2