General

  • Target

    ff5fd7ba4cdd0a39e7a53346af5fdc790c47051d017e80b635c5b4ee82d5f1bd.exe

  • Size

    6.3MB

  • Sample

    240926-c65geashkk

  • MD5

    d2ae1abde26f7debad39e95d83b23f2d

  • SHA1

    b7ba512ac811048377a837555905db1d31f01b7f

  • SHA256

    ff5fd7ba4cdd0a39e7a53346af5fdc790c47051d017e80b635c5b4ee82d5f1bd

  • SHA512

    4b544facc22f91255aac31203a92b91aa802a91733bfac4757597d7c95a4fec7a612a7ef232f283e5f5bd73b8c402c9947b814e09dc7af58f03742b6ea31f4cc

  • SSDEEP

    49152:m5t/+rS5A0o32tb1RRYjva02VRZUYNLA70wUiiGPqYUAlVC033AJXF44F6y14Kg4:MXRSTaJlRNLa0fiTPqXvsTo3GhpOX

Malware Config

Extracted

Family

cryptbot

C2

analforeverlovyu.top

twelvevd12vs.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      ff5fd7ba4cdd0a39e7a53346af5fdc790c47051d017e80b635c5b4ee82d5f1bd.exe

    • Size

      6.3MB

    • MD5

      d2ae1abde26f7debad39e95d83b23f2d

    • SHA1

      b7ba512ac811048377a837555905db1d31f01b7f

    • SHA256

      ff5fd7ba4cdd0a39e7a53346af5fdc790c47051d017e80b635c5b4ee82d5f1bd

    • SHA512

      4b544facc22f91255aac31203a92b91aa802a91733bfac4757597d7c95a4fec7a612a7ef232f283e5f5bd73b8c402c9947b814e09dc7af58f03742b6ea31f4cc

    • SSDEEP

      49152:m5t/+rS5A0o32tb1RRYjva02VRZUYNLA70wUiiGPqYUAlVC033AJXF44F6y14Kg4:MXRSTaJlRNLa0fiTPqXvsTo3GhpOX

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks