General

  • Target

    0ab7414641e2e2f9e1cf8ea3dc9d9f3a.exe

  • Size

    4.3MB

  • Sample

    241223-glbe2swqc1

  • MD5

    0ab7414641e2e2f9e1cf8ea3dc9d9f3a

  • SHA1

    d9ad680a3143b626c7b01a1c9582ea2d8cb660f8

  • SHA256

    527492845939bee88267250394d0342521939dd71fb7c274d0b0832bc7ff679a

  • SHA512

    51a1ed193a1be773490d6c8ad45bcab0023e22ed989d6f40b484d00cfb96632254a94b6203e72c1c14d39fe16905d465035a0c1e08b2739bbac718d09794d509

  • SSDEEP

    98304:FxhoRWdEiSqCzP394XJeW2ZLfrpwtdnrKrl2u10iEm:FxGRW2/qaPt4cW2ZbarKrwu10

Malware Config

Extracted

Family

cryptbot

Targets

    • Target

      0ab7414641e2e2f9e1cf8ea3dc9d9f3a.exe

    • Size

      4.3MB

    • MD5

      0ab7414641e2e2f9e1cf8ea3dc9d9f3a

    • SHA1

      d9ad680a3143b626c7b01a1c9582ea2d8cb660f8

    • SHA256

      527492845939bee88267250394d0342521939dd71fb7c274d0b0832bc7ff679a

    • SHA512

      51a1ed193a1be773490d6c8ad45bcab0023e22ed989d6f40b484d00cfb96632254a94b6203e72c1c14d39fe16905d465035a0c1e08b2739bbac718d09794d509

    • SSDEEP

      98304:FxhoRWdEiSqCzP394XJeW2ZLfrpwtdnrKrl2u10iEm:FxGRW2/qaPt4cW2ZbarKrwu10

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Enumerates VirtualBox registry keys

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks