General

  • Target

    290853a79ea4b4292ab9996a1d10616c120989df2585c702ddaca90daf92328aN

  • Size

    6.3MB

  • Sample

    241004-zfpplazcjf

  • MD5

    784c9c612df0b52043fa304c680c6ec0

  • SHA1

    f271ab69431e4b03016dee8d8c4e3231f51471c2

  • SHA256

    290853a79ea4b4292ab9996a1d10616c120989df2585c702ddaca90daf92328a

  • SHA512

    68ade75e1118a1aadab099400e66caf20b3dc13854923654313705421c1633ad6635aba2c4cedcec39980b271a05cd6aa9646866b2624422b5e0889de51776e8

  • SSDEEP

    49152:XNRjnEDP0twL5UP4YLmUlp1ZVYYjHPwDaAO24S4Nuhv4hE+GOEWruX4K2CPg4lEi:xcKHPHQ47E+0L4TXyw9hAIUabti

Malware Config

Extracted

Family

cryptbot

C2

thirtvh13pt.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      290853a79ea4b4292ab9996a1d10616c120989df2585c702ddaca90daf92328aN

    • Size

      6.3MB

    • MD5

      784c9c612df0b52043fa304c680c6ec0

    • SHA1

      f271ab69431e4b03016dee8d8c4e3231f51471c2

    • SHA256

      290853a79ea4b4292ab9996a1d10616c120989df2585c702ddaca90daf92328a

    • SHA512

      68ade75e1118a1aadab099400e66caf20b3dc13854923654313705421c1633ad6635aba2c4cedcec39980b271a05cd6aa9646866b2624422b5e0889de51776e8

    • SSDEEP

      49152:XNRjnEDP0twL5UP4YLmUlp1ZVYYjHPwDaAO24S4Nuhv4hE+GOEWruX4K2CPg4lEi:xcKHPHQ47E+0L4TXyw9hAIUabti

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks