General

  • Target

    fcfb14707aa5abe3cf84d6059717246e6593cd43d60c609fe3095825827637c7

  • Size

    6.3MB

  • Sample

    240926-3fagfswerg

  • MD5

    d09d52b00ae2fd3ea3135aa31d7cb323

  • SHA1

    40c053b5a7f8e6e3c78895382662cf2556e3b2ea

  • SHA256

    fcfb14707aa5abe3cf84d6059717246e6593cd43d60c609fe3095825827637c7

  • SHA512

    1a126471a5972babceebd66008dc136e098b37a64a25521c8213887daf6a7cf3ece3058286c68e3ebec85a40b5a3e53a84e243381ffef4283941c70fc814f6a4

  • SSDEEP

    98304:LGTJl3KTi5z6OxS0B/idEmpI18H144HAyBdO:STJJKTi1rxnidjpI18V4CAyPO

Malware Config

Extracted

Family

lumma

Extracted

Family

cryptbot

C2

fivevh5vt.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      fcfb14707aa5abe3cf84d6059717246e6593cd43d60c609fe3095825827637c7

    • Size

      6.3MB

    • MD5

      d09d52b00ae2fd3ea3135aa31d7cb323

    • SHA1

      40c053b5a7f8e6e3c78895382662cf2556e3b2ea

    • SHA256

      fcfb14707aa5abe3cf84d6059717246e6593cd43d60c609fe3095825827637c7

    • SHA512

      1a126471a5972babceebd66008dc136e098b37a64a25521c8213887daf6a7cf3ece3058286c68e3ebec85a40b5a3e53a84e243381ffef4283941c70fc814f6a4

    • SSDEEP

      98304:LGTJl3KTi5z6OxS0B/idEmpI18H144HAyBdO:STJJKTi1rxnidjpI18V4CAyPO

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks