General

  • Target

    52e77ca6dd4e50ec597b767e0dffcb09724d30e97b475494efd919c0e58fcd98

  • Size

    6.4MB

  • Sample

    240905-zz1afazerc

  • MD5

    e5130309a7198e101e7d6c063fd52444

  • SHA1

    75bc2c08d3d65bcc3145b2fb44d940684d2dfb10

  • SHA256

    52e77ca6dd4e50ec597b767e0dffcb09724d30e97b475494efd919c0e58fcd98

  • SHA512

    383d19352ebb4e15b1183a46944156b37def06ab52cd3bbdd334b14db2c46c13ef2ce71f3b3c0df9a616525b2d875afcb9c82dbb29b7c14b636aff90127ee4e2

  • SSDEEP

    98304:vywJKhiu9YHt3Ahm1uCSpuD6N0Vyts7vLX34ZVsCft+vm3:vBKs0Yyhcuq6OV4SvLH4vsYOm3

Malware Config

Extracted

Family

cryptbot

C2

analforeverlovyu.top

sevtv17vt.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      52e77ca6dd4e50ec597b767e0dffcb09724d30e97b475494efd919c0e58fcd98

    • Size

      6.4MB

    • MD5

      e5130309a7198e101e7d6c063fd52444

    • SHA1

      75bc2c08d3d65bcc3145b2fb44d940684d2dfb10

    • SHA256

      52e77ca6dd4e50ec597b767e0dffcb09724d30e97b475494efd919c0e58fcd98

    • SHA512

      383d19352ebb4e15b1183a46944156b37def06ab52cd3bbdd334b14db2c46c13ef2ce71f3b3c0df9a616525b2d875afcb9c82dbb29b7c14b636aff90127ee4e2

    • SSDEEP

      98304:vywJKhiu9YHt3Ahm1uCSpuD6N0Vyts7vLX34ZVsCft+vm3:vBKs0Yyhcuq6OV4SvLH4vsYOm3

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks