General

  • Target

    29036a1125ac5f5b8a4bfb794fa965efd1f5e24853db3fa901b17d96ba901ca8.exe

  • Size

    6.3MB

  • Sample

    241219-cw679asrdx

  • MD5

    5f5eb3caf593e33ff2fd4b82db11084a

  • SHA1

    0d0fa72c99e0759c79b0f06fdcd74d1fb823ced5

  • SHA256

    29036a1125ac5f5b8a4bfb794fa965efd1f5e24853db3fa901b17d96ba901ca8

  • SHA512

    8b88d41a1ba2a1543eff933fbefacf5c6669fff37165515149e70cb784fd09e4b091f347cbf4111bbe9a57a571a6dfa46a36ceb8a235ec13ea656c382502d468

  • SSDEEP

    196608:h/5aE/yir6wt+yVZjinfFQoff+lhfskwlpG6TRj3Nv2vnY1bPMbdKBVQ:J5aE/rr6wt+yVZjinfGofmlhfs1lpGMs

Malware Config

Extracted

Family

cryptbot

C2

fivexx5ht.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      29036a1125ac5f5b8a4bfb794fa965efd1f5e24853db3fa901b17d96ba901ca8.exe

    • Size

      6.3MB

    • MD5

      5f5eb3caf593e33ff2fd4b82db11084a

    • SHA1

      0d0fa72c99e0759c79b0f06fdcd74d1fb823ced5

    • SHA256

      29036a1125ac5f5b8a4bfb794fa965efd1f5e24853db3fa901b17d96ba901ca8

    • SHA512

      8b88d41a1ba2a1543eff933fbefacf5c6669fff37165515149e70cb784fd09e4b091f347cbf4111bbe9a57a571a6dfa46a36ceb8a235ec13ea656c382502d468

    • SSDEEP

      196608:h/5aE/yir6wt+yVZjinfFQoff+lhfskwlpG6TRj3Nv2vnY1bPMbdKBVQ:J5aE/rr6wt+yVZjinfGofmlhfs1lpGMs

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks