General

  • Target

    DOC.exe

  • Size

    2.5MB

  • Sample

    241218-msvp6avrdw

  • MD5

    2dbdc645b9776239b18f772c30c1a626

  • SHA1

    8677b8ea4f077a8c708a0d894e18513828c30322

  • SHA256

    2b92d1c34b7f0278703c98e9fd755e061d0f120eea327996b223dfc65610dfcd

  • SHA512

    ae5499ad2c40bd8756d614fea51f48c7b8fca4621b489da97f05cc55cf4a9a6032f9ec0c70ed03915da0e021ed9e4cca16810b18d3825ece9dac25e1d74d6fec

  • SSDEEP

    49152:hhVSCIoIdMdFH/x0EtwDPbtjlEzVu0K64EiSADdUNigC:7Ivnq80bODdU6

Malware Config

Extracted

Family

cryptbot

C2

fivexc5vt.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      DOC.exe

    • Size

      2.5MB

    • MD5

      2dbdc645b9776239b18f772c30c1a626

    • SHA1

      8677b8ea4f077a8c708a0d894e18513828c30322

    • SHA256

      2b92d1c34b7f0278703c98e9fd755e061d0f120eea327996b223dfc65610dfcd

    • SHA512

      ae5499ad2c40bd8756d614fea51f48c7b8fca4621b489da97f05cc55cf4a9a6032f9ec0c70ed03915da0e021ed9e4cca16810b18d3825ece9dac25e1d74d6fec

    • SSDEEP

      49152:hhVSCIoIdMdFH/x0EtwDPbtjlEzVu0K64EiSADdUNigC:7Ivnq80bODdU6

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks