General

  • Target

    5f0f316459cf8e92f8705124acdbe3e4

  • Size

    746KB

  • Sample

    240116-fzaj8sega9

  • MD5

    5f0f316459cf8e92f8705124acdbe3e4

  • SHA1

    dd8ec58e0fb787491eae153bd02d3be825fa8f3a

  • SHA256

    b118e2deb33dc46a4ae01ba586feafcae96251267ab36dee8aa7f282b7263d13

  • SHA512

    5af5e66c8de74c941337d44315beb9ded9bf9ada0b8348820c87516ef5eb507ab44586afc7401d72e61b829d1bc2e87034cfe82eaf4353a3772653c4677854c4

  • SSDEEP

    12288:7n5IQdj9J0t1CIQklyPGt0dPf2OgiCjwnRl/1T7xu8+3oIa1oDVLBTv5NKrk52mB:7Nut1CIHlgGOgwnTu3zRtTX2kLB

Malware Config

Extracted

Family

cryptbot

C2

ewapyc22.top

morzup02.top

Attributes
  • payload_url

    http://winqoz02.top/download.php?file=lv.exe

Targets

    • Target

      5f0f316459cf8e92f8705124acdbe3e4

    • Size

      746KB

    • MD5

      5f0f316459cf8e92f8705124acdbe3e4

    • SHA1

      dd8ec58e0fb787491eae153bd02d3be825fa8f3a

    • SHA256

      b118e2deb33dc46a4ae01ba586feafcae96251267ab36dee8aa7f282b7263d13

    • SHA512

      5af5e66c8de74c941337d44315beb9ded9bf9ada0b8348820c87516ef5eb507ab44586afc7401d72e61b829d1bc2e87034cfe82eaf4353a3772653c4677854c4

    • SSDEEP

      12288:7n5IQdj9J0t1CIQklyPGt0dPf2OgiCjwnRl/1T7xu8+3oIa1oDVLBTv5NKrk52mB:7Nut1CIHlgGOgwnTu3zRtTX2kLB

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks