General

  • Target

    0e478492586f2899c4d61ce332c20f0d287df454b4bb1c27719054487487f43d

  • Size

    6.3MB

  • Sample

    240910-xdds7syfkl

  • MD5

    a788e0f4a17874952e61d7a97ea97278

  • SHA1

    dcfa5a02e720f2d0d5835308570863c7da75c92a

  • SHA256

    0e478492586f2899c4d61ce332c20f0d287df454b4bb1c27719054487487f43d

  • SHA512

    eda5a08649377a53ec3364f318ff69db995bcc018e0989921f2374c86083f01dab6e68e1e68738cd96993279668bfb78653762a9f5ff378f76fb18d32c044a64

  • SSDEEP

    49152:Be2inRsEfyPy3NrixfKz96kKtkWKVk96dd7xLEMwmhhCDcF6BNill:BEnlgKz4k/Vw6ddFAfQ6Xsl

Malware Config

Extracted

Family

cryptbot

C2

siv6pn.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      0e478492586f2899c4d61ce332c20f0d287df454b4bb1c27719054487487f43d

    • Size

      6.3MB

    • MD5

      a788e0f4a17874952e61d7a97ea97278

    • SHA1

      dcfa5a02e720f2d0d5835308570863c7da75c92a

    • SHA256

      0e478492586f2899c4d61ce332c20f0d287df454b4bb1c27719054487487f43d

    • SHA512

      eda5a08649377a53ec3364f318ff69db995bcc018e0989921f2374c86083f01dab6e68e1e68738cd96993279668bfb78653762a9f5ff378f76fb18d32c044a64

    • SSDEEP

      49152:Be2inRsEfyPy3NrixfKz96kKtkWKVk96dd7xLEMwmhhCDcF6BNill:BEnlgKz4k/Vw6ddFAfQ6Xsl

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks