General

  • Target

    0c27861f03c8d88d8ad32b06a63f329a9ad895312abb6878600aeb9ce745b67a

  • Size

    6.3MB

  • Sample

    240926-2fn46s1ejj

  • MD5

    950cfc590026c689357a2db4c9de3fa6

  • SHA1

    7fb0b7fd533b622c48cd02d056493aac1e93acbd

  • SHA256

    0c27861f03c8d88d8ad32b06a63f329a9ad895312abb6878600aeb9ce745b67a

  • SHA512

    9deac7312325799afd83a9df287b370e0dc917cedeac451c9d558a28e66e4c2b0aa7280d1728a295619d19b66c40b33da58a79ee0d04b5f59ff868d951964824

  • SSDEEP

    49152:d7mTqLmWtcNyB4DmikNPM7H2c1lZR6c8q2j2y3TeoQqu4UFafAocGl1pCvjpYZUf:lmCmymSPizH2eZR6cwj2y3ZPfjdSulL+

Malware Config

Extracted

Family

lumma

Extracted

Family

cryptbot

C2

tventyvf20vs.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      0c27861f03c8d88d8ad32b06a63f329a9ad895312abb6878600aeb9ce745b67a

    • Size

      6.3MB

    • MD5

      950cfc590026c689357a2db4c9de3fa6

    • SHA1

      7fb0b7fd533b622c48cd02d056493aac1e93acbd

    • SHA256

      0c27861f03c8d88d8ad32b06a63f329a9ad895312abb6878600aeb9ce745b67a

    • SHA512

      9deac7312325799afd83a9df287b370e0dc917cedeac451c9d558a28e66e4c2b0aa7280d1728a295619d19b66c40b33da58a79ee0d04b5f59ff868d951964824

    • SSDEEP

      49152:d7mTqLmWtcNyB4DmikNPM7H2c1lZR6c8q2j2y3TeoQqu4UFafAocGl1pCvjpYZUf:lmCmymSPizH2eZR6cwj2y3ZPfjdSulL+

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks