General

  • Target

    424861d0e10ce39aee891cf2586c619f.exe

  • Size

    4.2MB

  • Sample

    241217-km6t5avqc1

  • MD5

    424861d0e10ce39aee891cf2586c619f

  • SHA1

    f3833b816eedab4050d59cabbadbe0efa028c4e8

  • SHA256

    bf0d35bcc2b1b928547fa1e7817d68a7126b2fa28c26e417c2d79cc0b26289ec

  • SHA512

    7b812c6ea0eac16d9168b85701d0fa42ef1520f4d14ff9baf78414282340be4c2d03ba4e56b38d2735928c06270a8c052a45dbf49ad96fe8b06b3a5709a941e6

  • SSDEEP

    98304:baZwuP2maaEkOUAS9bKERXBtsNxqd2hq7wAi/w:wwueWEkbKEXmEhkw

Malware Config

Extracted

Family

cryptbot

Targets

    • Target

      424861d0e10ce39aee891cf2586c619f.exe

    • Size

      4.2MB

    • MD5

      424861d0e10ce39aee891cf2586c619f

    • SHA1

      f3833b816eedab4050d59cabbadbe0efa028c4e8

    • SHA256

      bf0d35bcc2b1b928547fa1e7817d68a7126b2fa28c26e417c2d79cc0b26289ec

    • SHA512

      7b812c6ea0eac16d9168b85701d0fa42ef1520f4d14ff9baf78414282340be4c2d03ba4e56b38d2735928c06270a8c052a45dbf49ad96fe8b06b3a5709a941e6

    • SSDEEP

      98304:baZwuP2maaEkOUAS9bKERXBtsNxqd2hq7wAi/w:wwueWEkbKEXmEhkw

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Enumerates VirtualBox registry keys

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks