General

  • Target

    c7853ddf9ccddb320b32c8b96ba4c6657cd64b92d23f0278f2d73ea72935b5e7

  • Size

    6.3MB

  • Sample

    240917-bwq1laygqd

  • MD5

    49eb45720952572c8747ed89bc49e48f

  • SHA1

    040da21d64199123278984983066c24d1648955a

  • SHA256

    c7853ddf9ccddb320b32c8b96ba4c6657cd64b92d23f0278f2d73ea72935b5e7

  • SHA512

    f4d27d8831427fa1b499d63ebb183a242ee13c08721346d281db6fd30e3bc249a0559646aa081a7cab00d2ed4a0e7b8257fe69249d20b8a39113094bd85540a5

  • SSDEEP

    98304:USqn1ZQ1pS38DrZAnsDeWB7dv2BB9zsL0pE:US31GVnsqE92BG0pE

Malware Config

Extracted

Family

cryptbot

C2

forcj4sb.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      c7853ddf9ccddb320b32c8b96ba4c6657cd64b92d23f0278f2d73ea72935b5e7

    • Size

      6.3MB

    • MD5

      49eb45720952572c8747ed89bc49e48f

    • SHA1

      040da21d64199123278984983066c24d1648955a

    • SHA256

      c7853ddf9ccddb320b32c8b96ba4c6657cd64b92d23f0278f2d73ea72935b5e7

    • SHA512

      f4d27d8831427fa1b499d63ebb183a242ee13c08721346d281db6fd30e3bc249a0559646aa081a7cab00d2ed4a0e7b8257fe69249d20b8a39113094bd85540a5

    • SSDEEP

      98304:USqn1ZQ1pS38DrZAnsDeWB7dv2BB9zsL0pE:US31GVnsqE92BG0pE

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks