General

  • Target

    b30714fc6a774d139fcade4085397f9dcacbb2d17a9236924fa24c99ad840e88

  • Size

    6.3MB

  • Sample

    240917-a4km4sycnq

  • MD5

    df5b5ee899fad0a83fb9e0711fc13942

  • SHA1

    3d01b95c85ec5c3cbddd180530f9cddfddc70950

  • SHA256

    b30714fc6a774d139fcade4085397f9dcacbb2d17a9236924fa24c99ad840e88

  • SHA512

    2a6f92c6e582a71420af618e14bbe94f10a7c37a3d373098ffff67567e2cf6fe2b55e5f912de8815f34b1e9934e92ac689b89fe80e3deaadb918396bb28cb361

  • SSDEEP

    98304:AfIF6VlehPf6l/tOJrUETjtjWD7kWZ4DJVvb7:AfaClehPf6lVUUuMD7RcT7

Malware Config

Extracted

Family

cryptbot

C2

sixv16pn.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      b30714fc6a774d139fcade4085397f9dcacbb2d17a9236924fa24c99ad840e88

    • Size

      6.3MB

    • MD5

      df5b5ee899fad0a83fb9e0711fc13942

    • SHA1

      3d01b95c85ec5c3cbddd180530f9cddfddc70950

    • SHA256

      b30714fc6a774d139fcade4085397f9dcacbb2d17a9236924fa24c99ad840e88

    • SHA512

      2a6f92c6e582a71420af618e14bbe94f10a7c37a3d373098ffff67567e2cf6fe2b55e5f912de8815f34b1e9934e92ac689b89fe80e3deaadb918396bb28cb361

    • SSDEEP

      98304:AfIF6VlehPf6l/tOJrUETjtjWD7kWZ4DJVvb7:AfaClehPf6lVUUuMD7RcT7

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks