General

  • Target

    66dfd447dcd00_lyla.exe

  • Size

    6.3MB

  • Sample

    240910-lwk5fszakh

  • MD5

    b36f21ca653ea179246c98cda2373879

  • SHA1

    e51277a723ca0cc7f48d8e99dbc471f42b57cb62

  • SHA256

    ce083654b6506740c3a45c15e4fb24dcd05cd39e6509bdeeeedd330750a9511a

  • SHA512

    9c4baec021ce15717366fa2e29af22b28673515e5e837b4a2441842d6eaa1fe4b29d2e9f24809a38b637e18f2ba43db7848708d0ad53552fe26dcd7daa107e80

  • SSDEEP

    49152:LZQCY6KFqjMJ9nFpnRmTH4S3dvxqydZMuhLpR+mXsU4AXe8BRDWOvryIkAw3W:2C6R4BdvsydZrzZsU4AXNrDcIrgW

Malware Config

Extracted

Family

cryptbot

C2

tventyv20pn.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      66dfd447dcd00_lyla.exe

    • Size

      6.3MB

    • MD5

      b36f21ca653ea179246c98cda2373879

    • SHA1

      e51277a723ca0cc7f48d8e99dbc471f42b57cb62

    • SHA256

      ce083654b6506740c3a45c15e4fb24dcd05cd39e6509bdeeeedd330750a9511a

    • SHA512

      9c4baec021ce15717366fa2e29af22b28673515e5e837b4a2441842d6eaa1fe4b29d2e9f24809a38b637e18f2ba43db7848708d0ad53552fe26dcd7daa107e80

    • SSDEEP

      49152:LZQCY6KFqjMJ9nFpnRmTH4S3dvxqydZMuhLpR+mXsU4AXe8BRDWOvryIkAw3W:2C6R4BdvsydZrzZsU4AXNrDcIrgW

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks