Overview

overview

10

Static

static

3

eeb62173d7...18.exe

windows7-x64

10

eeb62173d7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eeb62173d7b2f4d2719c16b1dc2809fe_JaffaCakes118

  • Size

    574KB

  • Sample

    240412-at8xyshh83

  • MD5

    eeb62173d7b2f4d2719c16b1dc2809fe

  • SHA1

    acc4c9e1901a3fb601ce2f4e002023a2d8f3d556

  • SHA256

    6b9e4d4db87e97bddd7428853a603b4cf3de855b1016523bade50bc88904eca2

  • SHA512

    445ba6a41c46bcc86a815a6e293e40e5c7d9fddf91aaf0995791c30f55b0ef1c4fbf45a7a969c07226dcf8c12f2349d355186d11e196345add842cd2f55c7925

  • SSDEEP

    12288:1XW3sCPAMQi9JUK0cxlrS0R+gNrWL3hSh9ak87ti0WMRxwoO:1m8CPAduU5cxMHl3ho9ak87tdp

Score
10/10
cryptbotdiscoveryspywarestealer

Malware Config

Extracted

Family

cryptbot

C2

haiezf32.top

morcyr03.top
Attributes
  • payload_url

    http://zelstb04.top/download.php?file=lv.exe

Targets

    • Target

      eeb62173d7b2f4d2719c16b1dc2809fe_JaffaCakes118

    • Size

      574KB

    • MD5

      eeb62173d7b2f4d2719c16b1dc2809fe

    • SHA1

      acc4c9e1901a3fb601ce2f4e002023a2d8f3d556

    • SHA256

      6b9e4d4db87e97bddd7428853a603b4cf3de855b1016523bade50bc88904eca2

    • SHA512

      445ba6a41c46bcc86a815a6e293e40e5c7d9fddf91aaf0995791c30f55b0ef1c4fbf45a7a969c07226dcf8c12f2349d355186d11e196345add842cd2f55c7925

    • SSDEEP

      12288:1XW3sCPAMQi9JUK0cxlrS0R+gNrWL3hSh9ak87ti0WMRxwoO:1m8CPAduU5cxMHl3ho9ak87tdp

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks