General

  • Target

    7febc09c97d078d9617d71db6c6c41ed7f81fd332a01b7683108c453661d3ca8

  • Size

    6.3MB

  • Sample

    240926-2nva6a1hrm

  • MD5

    ae1c38b2c0209f39d1c5d544e5a5ecf7

  • SHA1

    7cc8c38efb8a3c4b2a858aa959a9337871e175a3

  • SHA256

    7febc09c97d078d9617d71db6c6c41ed7f81fd332a01b7683108c453661d3ca8

  • SHA512

    e65130829ad0837b5fb8a85083d89393c355064fd75a83f107d4477dd724c0356c74081dd2e22df2aac22d1c26169e9eb88a85105f83f24c8029d7f58bb96490

  • SSDEEP

    98304:MR7OR+Fx0lp21eiXdBYt3A0UR9nsqq1MlFC:+KRQav1i+T89nsqqWlFC

Malware Config

Extracted

Family

lumma

Extracted

Family

cryptbot

C2

fivevf5pt.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      7febc09c97d078d9617d71db6c6c41ed7f81fd332a01b7683108c453661d3ca8

    • Size

      6.3MB

    • MD5

      ae1c38b2c0209f39d1c5d544e5a5ecf7

    • SHA1

      7cc8c38efb8a3c4b2a858aa959a9337871e175a3

    • SHA256

      7febc09c97d078d9617d71db6c6c41ed7f81fd332a01b7683108c453661d3ca8

    • SHA512

      e65130829ad0837b5fb8a85083d89393c355064fd75a83f107d4477dd724c0356c74081dd2e22df2aac22d1c26169e9eb88a85105f83f24c8029d7f58bb96490

    • SSDEEP

      98304:MR7OR+Fx0lp21eiXdBYt3A0UR9nsqq1MlFC:+KRQav1i+T89nsqqWlFC

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks