General

  • Target

    e9de3019d8993801fd32f5e00492fa4f5d389100146a1f6f2d7170cb8b7afebd.exe

  • Size

    2.7MB

  • Sample

    241219-ez24taypbr

  • MD5

    eb89a69599c9d1dde409ac2b351d9a00

  • SHA1

    a708e9a84067fd6c398ddfd0ac11ae48d9c41e4c

  • SHA256

    e9de3019d8993801fd32f5e00492fa4f5d389100146a1f6f2d7170cb8b7afebd

  • SHA512

    e8fcf4b8ad1747df2595aeea190e2710a42668d4cf5291fa40f67a5317cecb6d62819c9fb26c541e509f756a40858d4714936ab0c5da6ebf62024c098b0f1876

  • SSDEEP

    49152:uzwwa0PRV8VL1244wlOgE7siYqtDNeH/5OyveFN94XLrduQaSP1k/nf2ZY2lIrnM:VONtDNQ53Kk43a

Malware Config

Extracted

Family

cryptbot

C2

fivexc5sr.top

analforeverlovyu.top

Attributes
  • url_path

    /v1/upload.php

Targets

    • Target

      e9de3019d8993801fd32f5e00492fa4f5d389100146a1f6f2d7170cb8b7afebd.exe

    • Size

      2.7MB

    • MD5

      eb89a69599c9d1dde409ac2b351d9a00

    • SHA1

      a708e9a84067fd6c398ddfd0ac11ae48d9c41e4c

    • SHA256

      e9de3019d8993801fd32f5e00492fa4f5d389100146a1f6f2d7170cb8b7afebd

    • SHA512

      e8fcf4b8ad1747df2595aeea190e2710a42668d4cf5291fa40f67a5317cecb6d62819c9fb26c541e509f756a40858d4714936ab0c5da6ebf62024c098b0f1876

    • SSDEEP

      49152:uzwwa0PRV8VL1244wlOgE7siYqtDNeH/5OyveFN94XLrduQaSP1k/nf2ZY2lIrnM:VONtDNQ53Kk43a

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks