General

  • Target

    0914519679dcf5949845252433430a5ab6854f6579e7adabcf36cffa5185624e

  • Size

    6.4MB

  • Sample

    240926-2fdnfatgjg

  • MD5

    7eb00a8530082c8beda132921de5f11a

  • SHA1

    b05af1b0ca5db6ec2f63d30ad189016de4d5f18d

  • SHA256

    0914519679dcf5949845252433430a5ab6854f6579e7adabcf36cffa5185624e

  • SHA512

    2a6c9b4c891ff66a56fcef7b0268133da83b21cdea853a6e69ac0d86f9e6b9da27794eeb49f00f79d917a4c27081db42c1a71c354842e456d15c43a440d22346

  • SSDEEP

    98304:U5xwEVmSCPfcvxypwXh99jIY+hpH/e+tqzfF1c4KPI:U5x61PkvwwOYS4+tqDFXKPI

Malware Config

Extracted

Family

lumma

Extracted

Family

cryptbot

C2

thirtvf13pt.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      0914519679dcf5949845252433430a5ab6854f6579e7adabcf36cffa5185624e

    • Size

      6.4MB

    • MD5

      7eb00a8530082c8beda132921de5f11a

    • SHA1

      b05af1b0ca5db6ec2f63d30ad189016de4d5f18d

    • SHA256

      0914519679dcf5949845252433430a5ab6854f6579e7adabcf36cffa5185624e

    • SHA512

      2a6c9b4c891ff66a56fcef7b0268133da83b21cdea853a6e69ac0d86f9e6b9da27794eeb49f00f79d917a4c27081db42c1a71c354842e456d15c43a440d22346

    • SSDEEP

      98304:U5xwEVmSCPfcvxypwXh99jIY+hpH/e+tqzfF1c4KPI:U5x61PkvwwOYS4+tqDFXKPI

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks