cryptbot

General

Target

eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118
Size

4.7MB
Sample

240410-tcqjtsgd6w
MD5

eb6db30e23d77e2740d98a5c23fe0920
SHA1

e61ecab00d442eced5be53a52f4ee04df54747f8
SHA256

9453ddc4bebb87a937e3d53d38c56814907b2862496142ccdb568f48caf2d467
SHA512

62861609f90b6407ac1ed6ce53fbb7434f79edc45caaaf84ef4541f882be910f41443e8b0c27c73383422b88539dd5f3daf1ef72229c0e51c456cabfe12eda6a
SSDEEP

98304:x5CvLUBsgMTSv4Rk02/43SBeiKQLDUep6lOtIO0lErExB:xyLUCg5v8TQLoe4lJlAa

Malware Config

Extracted

Family

nullmixer

C2

http://hsiens.xyz/

Extracted

Family

privateloader

C2

http://37.0.10.214/proxies.txt

http://37.0.10.244/server.txt

http://wfsdragon.ru/api/setStats.php

37.0.10.237

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

redline

Botnet

pub1

C2

viacetequn.site:80

Extracted

Family

vidar

Version

40.1

Botnet

706

C2

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Targets

- Target
  
  eb6db30e23d77e2740d98a5c23fe0920_JaffaCakes118
- Size
  
  4.7MB
- MD5
  
  eb6db30e23d77e2740d98a5c23fe0920
- SHA1
  
  e61ecab00d442eced5be53a52f4ee04df54747f8
- SHA256
  
  9453ddc4bebb87a937e3d53d38c56814907b2862496142ccdb568f48caf2d467
- SHA512
  
  62861609f90b6407ac1ed6ce53fbb7434f79edc45caaaf84ef4541f882be910f41443e8b0c27c73383422b88539dd5f3daf1ef72229c0e51c456cabfe12eda6a
- SSDEEP
  
  98304:x5CvLUBsgMTSv4Rk02/43SBeiKQLDUep6lOtIO0lErExB:xyLUCg5v8TQLoe4lJlAa
Score

10^/10

cryptbot nullmixer privateloader redline sectoprat smokeloader pub1 pub5 aspackv2 backdoor discovery dropper infostealer loader persistence rat spyware stealer trojan vidar 706
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- CryptBot payload
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2