General

  • Target

    f0d90c47fc980cb5b9678d4e5cb6378c.exe

  • Size

    4.2MB

  • Sample

    241218-ymjlgszrhp

  • MD5

    f0d90c47fc980cb5b9678d4e5cb6378c

  • SHA1

    c18a90dea4a0e2aa52116cda2f98a2d4d9eee3b8

  • SHA256

    eda574b714702a176c03a18f1cc966361d9245851dc44d97f498527ffa0268ba

  • SHA512

    5eed97a7d1fa1cceb1c0f83bacf95b7b6f4899eeb16599c4677630a260a8d0488e5bcf2a80ad3c4e255072eeb8e1c8a564ec4425e2dbb29020e74ad9494e8354

  • SSDEEP

    49152:ld3nKRZZiqsSWlRakSzLlRcsvnhJqOdxj/RwMJQY58fOwKYULVnTUNMficf2o3bR:ld3LqAS/lRLfhJEMRlrVWk85SMiDt

Malware Config

Extracted

Family

cryptbot

Targets

    • Target

      f0d90c47fc980cb5b9678d4e5cb6378c.exe

    • Size

      4.2MB

    • MD5

      f0d90c47fc980cb5b9678d4e5cb6378c

    • SHA1

      c18a90dea4a0e2aa52116cda2f98a2d4d9eee3b8

    • SHA256

      eda574b714702a176c03a18f1cc966361d9245851dc44d97f498527ffa0268ba

    • SHA512

      5eed97a7d1fa1cceb1c0f83bacf95b7b6f4899eeb16599c4677630a260a8d0488e5bcf2a80ad3c4e255072eeb8e1c8a564ec4425e2dbb29020e74ad9494e8354

    • SSDEEP

      49152:ld3nKRZZiqsSWlRakSzLlRcsvnhJqOdxj/RwMJQY58fOwKYULVnTUNMficf2o3bR:ld3LqAS/lRLfhJEMRlrVWk85SMiDt

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Enumerates VirtualBox registry keys

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks