General

  • Target

    602a928d359a1dfe3d504a1fb64bd32afe8d337c4f153d211495ecdf88223dd0

  • Size

    2.5MB

  • Sample

    240916-mr7y4atbnl

  • MD5

    a81ffbc15a8227ef178a4c8cf4ca695b

  • SHA1

    9cac5697946dc88088fbe32d3c3b1e2fc7cca718

  • SHA256

    602a928d359a1dfe3d504a1fb64bd32afe8d337c4f153d211495ecdf88223dd0

  • SHA512

    b48ae864f3d7e529317303294cec222c72cb085d36e92d1f54b0ead864ccc24c8f287834f9ab33cf57c899644da86a43c44584c8ac12065d87e2ab3d5c3a9f43

  • SSDEEP

    49152:dVWe0hxIUsXO3qUnOpLvPmsdR635x/gXEJtCQ970RkXwhnL8bY67Q3ip:dD0hxIUs+3qy3Qe

Malware Config

Extracted

Family

cryptbot

C2

tvtwel12vt.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      602a928d359a1dfe3d504a1fb64bd32afe8d337c4f153d211495ecdf88223dd0

    • Size

      2.5MB

    • MD5

      a81ffbc15a8227ef178a4c8cf4ca695b

    • SHA1

      9cac5697946dc88088fbe32d3c3b1e2fc7cca718

    • SHA256

      602a928d359a1dfe3d504a1fb64bd32afe8d337c4f153d211495ecdf88223dd0

    • SHA512

      b48ae864f3d7e529317303294cec222c72cb085d36e92d1f54b0ead864ccc24c8f287834f9ab33cf57c899644da86a43c44584c8ac12065d87e2ab3d5c3a9f43

    • SSDEEP

      49152:dVWe0hxIUsXO3qUnOpLvPmsdR635x/gXEJtCQ970RkXwhnL8bY67Q3ip:dD0hxIUs+3qy3Qe

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks