General

  • Target

    cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38

  • Size

    9.5MB

  • Sample

    241010-ca46rsthkg

  • MD5

    00f86418396c17d89d43328753aa0e94

  • SHA1

    535724a5b79937c3241e59460cf8f0b461625b22

  • SHA256

    cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38

  • SHA512

    5e3d6e058c0a7d78581c0c354b2d43d755afa3fdb25d5e308816e0a336f945e4b6d59a3cbea9a790f45c4ce516c6caf698400e1695a3a51fab4343ead9738c28

  • SSDEEP

    49152:5VpdkTXbGT7Zx6BhJ+exaueO63nsk0MEwJZpxm2TfP77LIYoMRBW:5pkLbGP/6fJ+

Malware Config

Extracted

Family

cryptbot

C2

fivevc5vs.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38

    • Size

      9.5MB

    • MD5

      00f86418396c17d89d43328753aa0e94

    • SHA1

      535724a5b79937c3241e59460cf8f0b461625b22

    • SHA256

      cb5f4641a3d416400f25611738e50f3cee8479c6d2c5ade6e4a2c36a14ac2e38

    • SHA512

      5e3d6e058c0a7d78581c0c354b2d43d755afa3fdb25d5e308816e0a336f945e4b6d59a3cbea9a790f45c4ce516c6caf698400e1695a3a51fab4343ead9738c28

    • SSDEEP

      49152:5VpdkTXbGT7Zx6BhJ+exaueO63nsk0MEwJZpxm2TfP77LIYoMRBW:5pkLbGP/6fJ+

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks