General

  • Target

    1dac4bd2e15c7e98e3e8c657e9f6463f6d4f7d6a1256a3270649bfa5154c9e73.exe

  • Size

    6.3MB

  • Sample

    241219-cr55dstlhm

  • MD5

    703bea610f53655fa0014b93f0fa4b7e

  • SHA1

    a3caccfaeffc6c6c39644404ad93455d37f0cdab

  • SHA256

    1dac4bd2e15c7e98e3e8c657e9f6463f6d4f7d6a1256a3270649bfa5154c9e73

  • SHA512

    9d083a762a23c05e9a084a6424a0852725ed4fb010b074416228034c4bbbbfce2bcfc9cf3e9f24f719d768cf8204eade9d3dcaf4a414c79fcb4b4f5af4986aeb

  • SSDEEP

    98304:FQAe5kuZp6Qrb0iF0MdenCghMYAvFrUtK:FQAe2uL0DCghMjvFwtK

Malware Config

Extracted

Family

cryptbot

C2

analforeverlovyu.top

tvexv20vt.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      1dac4bd2e15c7e98e3e8c657e9f6463f6d4f7d6a1256a3270649bfa5154c9e73.exe

    • Size

      6.3MB

    • MD5

      703bea610f53655fa0014b93f0fa4b7e

    • SHA1

      a3caccfaeffc6c6c39644404ad93455d37f0cdab

    • SHA256

      1dac4bd2e15c7e98e3e8c657e9f6463f6d4f7d6a1256a3270649bfa5154c9e73

    • SHA512

      9d083a762a23c05e9a084a6424a0852725ed4fb010b074416228034c4bbbbfce2bcfc9cf3e9f24f719d768cf8204eade9d3dcaf4a414c79fcb4b4f5af4986aeb

    • SSDEEP

      98304:FQAe5kuZp6Qrb0iF0MdenCghMYAvFrUtK:FQAe2uL0DCghMjvFwtK

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks