General

  • Target

    a30e07e78c6b5fb65880b0f7cbcc81d74a7dfbad8aad1b6601c2c53b68dcf882

  • Size

    2.5MB

  • Sample

    240916-g7z1jasgpd

  • MD5

    cb225477c483e2695c02ce92839ea881

  • SHA1

    c781aacfafaf55b3982047a50aded4215bf67bde

  • SHA256

    a30e07e78c6b5fb65880b0f7cbcc81d74a7dfbad8aad1b6601c2c53b68dcf882

  • SHA512

    5e170f59993d39423743ce78abca79412c4f5196a4ccefcbfd57d5d26c79faf993f16734e5c4fc1a78c56299dd9c585c13c770fc07cd7c9f5546b3ba955611e2

  • SSDEEP

    49152:9B+fdbA3zwPrcCAfcExULf+6NpDCd9QmNwvKhht+iP:9B+u3cCSKhPxP

Malware Config

Extracted

Family

cryptbot

C2

tvthre3sr.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      a30e07e78c6b5fb65880b0f7cbcc81d74a7dfbad8aad1b6601c2c53b68dcf882

    • Size

      2.5MB

    • MD5

      cb225477c483e2695c02ce92839ea881

    • SHA1

      c781aacfafaf55b3982047a50aded4215bf67bde

    • SHA256

      a30e07e78c6b5fb65880b0f7cbcc81d74a7dfbad8aad1b6601c2c53b68dcf882

    • SHA512

      5e170f59993d39423743ce78abca79412c4f5196a4ccefcbfd57d5d26c79faf993f16734e5c4fc1a78c56299dd9c585c13c770fc07cd7c9f5546b3ba955611e2

    • SSDEEP

      49152:9B+fdbA3zwPrcCAfcExULf+6NpDCd9QmNwvKhht+iP:9B+u3cCSKhPxP

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks