General

  • Target

    99405007ac24a23f98bcde50de740a4c4f00cd827dd4918ff72049af77210391

  • Size

    2.5MB

  • Sample

    240916-g718latamq

  • MD5

    85464cf2ab46df154e33f2b226a78693

  • SHA1

    4825cb8371e363f7ce41d874cca1ce51150fe3b1

  • SHA256

    99405007ac24a23f98bcde50de740a4c4f00cd827dd4918ff72049af77210391

  • SHA512

    c3aa158a12f8ce3e9e07cbb7f279571dab6d6e0842205c26bf6bf1076744ebaa72d95f15154e02f0d2e27014a4be66b11f7ae986b125af758ce0a2aedbaa003a

  • SSDEEP

    49152:ucimzG0C2yNNjrU7YNSk/M1h1K5wmbLMOnQBZtzMFagO2ttmt6Pwg4RcmkWZ3GrW:oc3s6SblqmkvKq

Malware Config

Extracted

Family

cryptbot

C2

tvfive5vt.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      99405007ac24a23f98bcde50de740a4c4f00cd827dd4918ff72049af77210391

    • Size

      2.5MB

    • MD5

      85464cf2ab46df154e33f2b226a78693

    • SHA1

      4825cb8371e363f7ce41d874cca1ce51150fe3b1

    • SHA256

      99405007ac24a23f98bcde50de740a4c4f00cd827dd4918ff72049af77210391

    • SHA512

      c3aa158a12f8ce3e9e07cbb7f279571dab6d6e0842205c26bf6bf1076744ebaa72d95f15154e02f0d2e27014a4be66b11f7ae986b125af758ce0a2aedbaa003a

    • SSDEEP

      49152:ucimzG0C2yNNjrU7YNSk/M1h1K5wmbLMOnQBZtzMFagO2ttmt6Pwg4RcmkWZ3GrW:oc3s6SblqmkvKq

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks