General

  • Target

    3a79351bd8099a518ecb4258aacecc84f7ed44cf67426b482b7583ce20c17e4e.exe

  • Size

    6.4MB

  • Sample

    241219-c4m5catlez

  • MD5

    9436c63eb99d4933ec7ffd0661639cbe

  • SHA1

    12da487e8e0a42a1a40ed00ee8708e8c6eed1800

  • SHA256

    3a79351bd8099a518ecb4258aacecc84f7ed44cf67426b482b7583ce20c17e4e

  • SHA512

    59bc369bf7d96865be7e2f0b148e8216804c7f85d59958e7cc142770b44a84a266db8aec05b28bed483828f84abd81a21b3d40cdda230c1a534f6b380a387c44

  • SSDEEP

    98304:GUdayOhRSDm9Pa0Yn7jUQY1bmG0ko9EMIvFPR:GXySRSDYY7jUD1bmG099EMaFPR

Malware Config

Extracted

Family

cryptbot

C2

fivexx5ht.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      3a79351bd8099a518ecb4258aacecc84f7ed44cf67426b482b7583ce20c17e4e.exe

    • Size

      6.4MB

    • MD5

      9436c63eb99d4933ec7ffd0661639cbe

    • SHA1

      12da487e8e0a42a1a40ed00ee8708e8c6eed1800

    • SHA256

      3a79351bd8099a518ecb4258aacecc84f7ed44cf67426b482b7583ce20c17e4e

    • SHA512

      59bc369bf7d96865be7e2f0b148e8216804c7f85d59958e7cc142770b44a84a266db8aec05b28bed483828f84abd81a21b3d40cdda230c1a534f6b380a387c44

    • SSDEEP

      98304:GUdayOhRSDm9Pa0Yn7jUQY1bmG0ko9EMIvFPR:GXySRSDYY7jUD1bmG099EMaFPR

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks