General
-
Target
aa8e0fb6c09f27d0d23f583673bb9ae3c44dec55b13eaeea2528f29d5d619d5e.exe
-
Size
6.4MB
-
Sample
240907-bz6v8aycmm
-
MD5
542792bb9e8a5e203dbc6271f6cdebf1
-
SHA1
1352785f6a17b9591ca9e7adf5981af40f1bf1bd
-
SHA256
aa8e0fb6c09f27d0d23f583673bb9ae3c44dec55b13eaeea2528f29d5d619d5e
-
SHA512
83af3bd1b681d5ae1e55c0ac3cada4644ad1229694c9d9db780c018d3b66621a1d9e2855d19df4b9acd4b8b6d6d66912b01bcb873dacdc0e0f8a99576bb1969c
-
SSDEEP
98304:yOs/6FovWTGaNXibHXmlyRWpLwphtfrDXQgw:yOsCFVaAXkM7FytzTBw
Static task
static1
Behavioral task
behavioral1
Sample
aa8e0fb6c09f27d0d23f583673bb9ae3c44dec55b13eaeea2528f29d5d619d5e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
aa8e0fb6c09f27d0d23f583673bb9ae3c44dec55b13eaeea2528f29d5d619d5e.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
cryptbot
twov2pt.top
analforeverlovyu.top
-
url_path
/v1/upload.php
Targets
-
-
Target
aa8e0fb6c09f27d0d23f583673bb9ae3c44dec55b13eaeea2528f29d5d619d5e.exe
-
Size
6.4MB
-
MD5
542792bb9e8a5e203dbc6271f6cdebf1
-
SHA1
1352785f6a17b9591ca9e7adf5981af40f1bf1bd
-
SHA256
aa8e0fb6c09f27d0d23f583673bb9ae3c44dec55b13eaeea2528f29d5d619d5e
-
SHA512
83af3bd1b681d5ae1e55c0ac3cada4644ad1229694c9d9db780c018d3b66621a1d9e2855d19df4b9acd4b8b6d6d66912b01bcb873dacdc0e0f8a99576bb1969c
-
SSDEEP
98304:yOs/6FovWTGaNXibHXmlyRWpLwphtfrDXQgw:yOsCFVaAXkM7FytzTBw
Score10/10-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-