General

  • Target

    0e2790b58ae8f3d43c184979e354fd415e990488d7e4a3f5c8aacfc5d0f1ed68

  • Size

    9.5MB

  • Sample

    241015-vnsn1azhlp

  • MD5

    b5709de87740787158cb6bdfb4106342

  • SHA1

    fb7a6a7a2b4fb3b9c9a8dc80194d5747e0701715

  • SHA256

    0e2790b58ae8f3d43c184979e354fd415e990488d7e4a3f5c8aacfc5d0f1ed68

  • SHA512

    3298bf4eea8e5d11ef0919caefbd08bef21f716735f5aa325299d9ab9e76b505a188e4baf4116ff5caeaf67783f2db66378f4c2fc000de3b58905b8fd256546a

  • SSDEEP

    49152:CUJ8u0q2/+Lvye47CzAY7zoqhr5uerH3HUkt59NiqaSDT8QpQt5JhGWH/vfcM8YW:hUq8+Lw7CMYIi

Malware Config

Extracted

Family

cryptbot

C2

fivevc5pn.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      0e2790b58ae8f3d43c184979e354fd415e990488d7e4a3f5c8aacfc5d0f1ed68

    • Size

      9.5MB

    • MD5

      b5709de87740787158cb6bdfb4106342

    • SHA1

      fb7a6a7a2b4fb3b9c9a8dc80194d5747e0701715

    • SHA256

      0e2790b58ae8f3d43c184979e354fd415e990488d7e4a3f5c8aacfc5d0f1ed68

    • SHA512

      3298bf4eea8e5d11ef0919caefbd08bef21f716735f5aa325299d9ab9e76b505a188e4baf4116ff5caeaf67783f2db66378f4c2fc000de3b58905b8fd256546a

    • SSDEEP

      49152:CUJ8u0q2/+Lvye47CzAY7zoqhr5uerH3HUkt59NiqaSDT8QpQt5JhGWH/vfcM8YW:hUq8+Lw7CMYIi

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks