General

  • Target

    6838a3bdb0c4193c1323c14541087b4b6025440997503ec189f6cf41fc7ca9ba

  • Size

    2.5MB

  • Sample

    240916-mt1msstbkb

  • MD5

    7eb16e23f8e404d2ce9f1f233771e1ae

  • SHA1

    3abaa49ee25681d48e26fa9a288b4bffd5885dc3

  • SHA256

    6838a3bdb0c4193c1323c14541087b4b6025440997503ec189f6cf41fc7ca9ba

  • SHA512

    c88b80075e1f1f1fa1cc5fbfc8d5442119aede1c939df3758472211b042ace64c6f46781b610aff948ce0407db7171836b764007eeb49b464ee6f84a9460090c

  • SSDEEP

    49152:TMm47v6342m+WLMt4Ky+1HxmD5gv06aWdTKPm:8631wMlxmD5gv03WdT/

Malware Config

Extracted

Family

cryptbot

C2

tvsixt16vs.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      6838a3bdb0c4193c1323c14541087b4b6025440997503ec189f6cf41fc7ca9ba

    • Size

      2.5MB

    • MD5

      7eb16e23f8e404d2ce9f1f233771e1ae

    • SHA1

      3abaa49ee25681d48e26fa9a288b4bffd5885dc3

    • SHA256

      6838a3bdb0c4193c1323c14541087b4b6025440997503ec189f6cf41fc7ca9ba

    • SHA512

      c88b80075e1f1f1fa1cc5fbfc8d5442119aede1c939df3758472211b042ace64c6f46781b610aff948ce0407db7171836b764007eeb49b464ee6f84a9460090c

    • SSDEEP

      49152:TMm47v6342m+WLMt4Ky+1HxmD5gv06aWdTKPm:8631wMlxmD5gv03WdT/

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks