cryptbot

General

Target

d1eec7914a5ca2f3e3a0b4c3c4e557ef.bin
Size

2.4MB
Sample

240319-d8cd3shc61
MD5

d1eec7914a5ca2f3e3a0b4c3c4e557ef
SHA1

f655fcf0e1ecf1a79a6c19d71fba9714611c1bef
SHA256

56e45f6af87cf8505b1d88360f14bf00bca7be5108db4d4283fab4605fca2482
SHA512

0f640a7649b2b3fadf2686f3fb0fb811bee25f6eeb7591909ba2671036ef933604166737dc74eb22c12851330c027124522a3deee5317f62873b77b7325f163d
SSDEEP

49152:9gTtVRY265B7HhR5V12uJ63B2ZOS7u0dpTLvvt0pzxNCoFWBusIpY34NK+y:yTtVOBrvh9J63M9iiNLv1I2oFWBuNpGt

Malware Config

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

cryptbot

C2

lysuht78.top

morisc07.top

Attributes

payload_url
http://damysa10.top/download.php?file=lv.exe

Extracted

Family

vidar

Version

40

Botnet

706

C2

https://lenak513.tumblr.com/

Attributes

profile_id
706

Extracted

Family

redline

Botnet

test1

C2

185.215.113.15:61506

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Targets

- Target
  
  d1eec7914a5ca2f3e3a0b4c3c4e557ef.bin
- Size
  
  2.4MB
- MD5
  
  d1eec7914a5ca2f3e3a0b4c3c4e557ef
- SHA1
  
  f655fcf0e1ecf1a79a6c19d71fba9714611c1bef
- SHA256
  
  56e45f6af87cf8505b1d88360f14bf00bca7be5108db4d4283fab4605fca2482
- SHA512
  
  0f640a7649b2b3fadf2686f3fb0fb811bee25f6eeb7591909ba2671036ef933604166737dc74eb22c12851330c027124522a3deee5317f62873b77b7325f163d
- SSDEEP
  
  49152:9gTtVRY265B7HhR5V12uJ63B2ZOS7u0dpTLvvt0pzxNCoFWBusIpY34NK+y:yTtVOBrvh9J63M9iiNLv1I2oFWBuNpGt
Score

10^/10

cryptbot nullmixer privateloader redline sectoprat smokeloader vidar 706 pub5 test1 aspackv2 backdoor discovery dropper infostealer loader rat spyware stealer trojan
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- CryptBot payload
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2
- Target
  
  setup_installer.exe
- Size
  
  2.4MB
- MD5
  
  4f39071ae96bbe636085ff30b895d630
- SHA1
  
  e790358c6f84900a02e72ffc56158c29ace40619
- SHA256
  
  2990a3bec6a52f106787fbdcebd73ebe67bbb6d903ef9e7bfd3fa71f51988e1f
- SHA512
  
  f906bb6dc96dc53ccabc673d44e8ba1d5cffc092ec700958dc028b67aa1c37184895ac3bb8921c92a381dcc4d916d6e7b3ca41fce0ff9495e37cd4f9b1019716
- SSDEEP
  
  49152:xcB9EwJ84vLRaBtIl9mVAJz9viFFGu+TFGeTJhDVLkqosBUNs/fYZ0qN9M8/p:xXCvLUBsgSz8FFcFGAPVnosBUNGf7qnl
Score

10^/10

cryptbot nullmixer privateloader redline sectoprat smokeloader vidar 706 pub5 test1 aspackv2 backdoor discovery dropper infostealer loader rat spyware stealer trojan
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- CryptBot payload
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral3 behavioral4