General

  • Target

    17ae975bc89c6255bb747b81a28199bd962643f706121ab98b2112f015a9a087.exe

  • Size

    6.3MB

  • Sample

    241005-jtmt6aybkg

  • MD5

    d66f93f2791e94bc6edf57b008e7bbec

  • SHA1

    6f116bfa8de52fd448f197427588744fabe9b2da

  • SHA256

    17ae975bc89c6255bb747b81a28199bd962643f706121ab98b2112f015a9a087

  • SHA512

    ad48e838c76890f0f05e102c9974c9ecab7ea05eacc3b37bc6ec4023e0d59c00519452170dd1f8e86cc8599c15d660839617bce42d25a3febd77edba80fe5ae3

  • SSDEEP

    49152:d3cOGrck8pKol6VHPrxMgc9NpEOQpMsMFvvB5EkoV/fS5weeVRay7LcNen:dcOMiKVVHP7dKPpIVIweeVIy7Acn

Malware Config

Extracted

Family

cryptbot

C2

fivevh5ht.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      17ae975bc89c6255bb747b81a28199bd962643f706121ab98b2112f015a9a087.exe

    • Size

      6.3MB

    • MD5

      d66f93f2791e94bc6edf57b008e7bbec

    • SHA1

      6f116bfa8de52fd448f197427588744fabe9b2da

    • SHA256

      17ae975bc89c6255bb747b81a28199bd962643f706121ab98b2112f015a9a087

    • SHA512

      ad48e838c76890f0f05e102c9974c9ecab7ea05eacc3b37bc6ec4023e0d59c00519452170dd1f8e86cc8599c15d660839617bce42d25a3febd77edba80fe5ae3

    • SSDEEP

      49152:d3cOGrck8pKol6VHPrxMgc9NpEOQpMsMFvvB5EkoV/fS5weeVRay7LcNen:dcOMiKVVHP7dKPpIVIweeVIy7Acn

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks