General

  • Target

    ✥LaTesT⟶ SeTuP⟶ pAsS⟶ oPeN⟶ 9192✥ (9192).zip

  • Size

    21.2MB

  • Sample

    241022-ja6g6atfmc

  • MD5

    fe88a3481918bbe2b291a87f40d08132

  • SHA1

    97ea31eac7fae35d5dec106d7b9aa6c31a69748d

  • SHA256

    5e3b30b55ba876f28544f2b89a7b4fa553b087b7f483fb272d9411ed31080274

  • SHA512

    1b3eb2791f1931788af1ebaa8e6985160d64586bb2aef5d38437255e21af0d593cfbc07043bab73320fcd53c434f6a73b8bc52c9a05e84f26c4315d7e4f10a22

  • SSDEEP

    393216:8sXJOQuay22qXoFTXud2itkT5nMf/bBBe9a2eUgSHPaTaz/nC/vVh4/jk:8mYaeqXo0dnG8DBBe9a2r9HPaTaz/n2D

Malware Config

Targets

    • Target

      Set-up.exe

    • Size

      6.5MB

    • MD5

      771dbdbbfc1a5a6fd637a1a62fd89845

    • SHA1

      264bdb27339bd0df80a60335169642d8ec90b84a

    • SHA256

      b8a63af1e287f5a2a1f25903642ce939779e9b87f971a9d158e113cb3298fefe

    • SHA512

      6b9b4c8b354993d5c34cbe27f139e0d7b607364951d71f1660323b0d89bc0a385073ada27ac1400feed8c64e1bc28cf45fd629777d0cf49152326c9d4f01283b

    • SSDEEP

      49152:ZRGsVlLSDkE4V3Nuz9IvHRTqozbUYitLI7jwZ1swad7JRGWz/v/cMVVF1lKn380T:r5VduzqZTBnU5tIf/d

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Detects CryptBot payload

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks