General

  • Target

    23801a80437a377dc9cea81bea2540842cc468c71ee9a404cecff8135e960443.exe

  • Size

    4.2MB

  • Sample

    241119-vrrwwaylay

  • MD5

    a386fd54030aea11e3bf51ada071499a

  • SHA1

    aee5a202f1fea1cc670970df068e338891dfc215

  • SHA256

    23801a80437a377dc9cea81bea2540842cc468c71ee9a404cecff8135e960443

  • SHA512

    1b07dbc4ac976c5608c5eb6f3e1781748898efc086b963c79893b053c08f42d16e8576c83554df957cf336b19b6ba5905a077d79b8916b7bd4f0d73d1b765037

  • SSDEEP

    98304:wVRgxKrnMBOy3mQk4e6kwOmruSo1uEGpPUJsx6K:wkMTM8sk4zkP1SoM1a6x6K

Malware Config

Targets

    • Target

      23801a80437a377dc9cea81bea2540842cc468c71ee9a404cecff8135e960443.exe

    • Size

      4.2MB

    • MD5

      a386fd54030aea11e3bf51ada071499a

    • SHA1

      aee5a202f1fea1cc670970df068e338891dfc215

    • SHA256

      23801a80437a377dc9cea81bea2540842cc468c71ee9a404cecff8135e960443

    • SHA512

      1b07dbc4ac976c5608c5eb6f3e1781748898efc086b963c79893b053c08f42d16e8576c83554df957cf336b19b6ba5905a077d79b8916b7bd4f0d73d1b765037

    • SSDEEP

      98304:wVRgxKrnMBOy3mQk4e6kwOmruSo1uEGpPUJsx6K:wkMTM8sk4zkP1SoM1a6x6K

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Detects CryptBot payload

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks