General

  • Target

    49df1f993baea2dde87a7723cce4d16e4e761730d5f00173af472e4fd67cfd97

  • Size

    6.3MB

  • Sample

    240916-htnwsavbrl

  • MD5

    80cbe687002f14859f172e5530d26114

  • SHA1

    4873c15fcb8a318d44e56c0c910ad2a33355a052

  • SHA256

    49df1f993baea2dde87a7723cce4d16e4e761730d5f00173af472e4fd67cfd97

  • SHA512

    ab87fe943afcfc868a5648179569c4b8a7cb737f310aa6a6c599abeca0b4f1ce530fc89bb1db91b8b5124dbc46803e2d1753243f49c5ff97b0e856cbbf42bcdc

  • SSDEEP

    49152:UY6vRH/p5aNGWP7iV1KbEomLIhXVpY2Svs8mpRw2OqF6BwhHti4l4+YC8lKqn0hI:Qt+Lbvc2Svs8mpRwzqFMwAr95iNytV

Malware Config

Extracted

Family

cryptbot

C2

fivevd5pt.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      49df1f993baea2dde87a7723cce4d16e4e761730d5f00173af472e4fd67cfd97

    • Size

      6.3MB

    • MD5

      80cbe687002f14859f172e5530d26114

    • SHA1

      4873c15fcb8a318d44e56c0c910ad2a33355a052

    • SHA256

      49df1f993baea2dde87a7723cce4d16e4e761730d5f00173af472e4fd67cfd97

    • SHA512

      ab87fe943afcfc868a5648179569c4b8a7cb737f310aa6a6c599abeca0b4f1ce530fc89bb1db91b8b5124dbc46803e2d1753243f49c5ff97b0e856cbbf42bcdc

    • SSDEEP

      49152:UY6vRH/p5aNGWP7iV1KbEomLIhXVpY2Svs8mpRw2OqF6BwhHti4l4+YC8lKqn0hI:Qt+Lbvc2Svs8mpRwzqFMwAr95iNytV

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks