Overview

overview

10

Static

static

10

start-this-827.exe

windows7-x64

10

start-this-827.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    start-this-827.exe

  • Size

    7.6MB

  • Sample

    250129-qthnrsxmfl

  • MD5

    a3feeeb0b30e106a07e25420bc3251b8

  • SHA1

    b036ac98c03da13efd4e79788200d4045895e3b9

  • SHA256

    f547e0496838c475776821a193912e485805fb40644ba6d089a798a1edbc35ba

  • SHA512

    94cfe80cf7e914343f483f571bf50869a31c7fc3eb70418c6e52f95312e53f26e25ab03abca524baf5017b179656902c3c11192ccbc1248a17d75dd79cea5c08

  • SSDEEP

    49152:T6QTuKl38VCGnDTUsuLPyyJTCWhaUcBXb+IwNXE3MS8YlWBheHaNlKdbyvPyz8ZP:T6QYn/1ujJeUdchbRwhEHjtaKsyz8l

Score
10/10
cryptbotdefense_evasiondiscoveryspywarestealer

Malware Config

Extracted

Family

cryptbot

C2

http://home.thrtww13vt.top/quzflHxcFiQHARiMlHLt173

Targets

    • Target

      start-this-827.exe

    • Size

      7.6MB

    • MD5

      a3feeeb0b30e106a07e25420bc3251b8

    • SHA1

      b036ac98c03da13efd4e79788200d4045895e3b9

    • SHA256

      f547e0496838c475776821a193912e485805fb40644ba6d089a798a1edbc35ba

    • SHA512

      94cfe80cf7e914343f483f571bf50869a31c7fc3eb70418c6e52f95312e53f26e25ab03abca524baf5017b179656902c3c11192ccbc1248a17d75dd79cea5c08

    • SSDEEP

      49152:T6QTuKl38VCGnDTUsuLPyyJTCWhaUcBXb+IwNXE3MS8YlWBheHaNlKdbyvPyz8ZP:T6QYn/1ujJeUdchbRwhEHjtaKsyz8l

    Score
    10/10
    cryptbotdefense_evasiondiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • Cryptbot family

      cryptbot

    • Enumerates VirtualBox registry keys

      defense_evasion

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks