General

  • Target

    21117078149.zip

  • Size

    2.8MB

  • Sample

    250204-kjzxea1nhv

  • MD5

    fbb183f5544b31051b52648735453cbe

  • SHA1

    5828fb9b70b11b968f5ccd7b2ae82d6b8217c53f

  • SHA256

    4ae924afb673bac2a4b2931d2487f78a24a04d15a8057865366ea75887ed32f0

  • SHA512

    1860ec1f75ceae3c416f15e54f5a9fcb4aedfc6b3405b5d024082702019d6443ff4eaa923546d0176d6f3e87521893e4e17f1787c51a66d1a49d764b21d01917

  • SSDEEP

    49152:CFI7jCmI304HctBhpgLeurMHHmQEqRvREhwxJ1Daft1INg4j1yW22z6sokz:O8VI304Hcf/2yH1EqRZEhYa1Oj5Xp6H0

Malware Config

Extracted

Family

cryptbot

Targets

    • Target

      6d921e6a65cc2eff0705ee661376acbce75d2c42c8da20ab193449751b8cdb98

    • Size

      7.3MB

    • MD5

      583de8bfad2efd3fafec090e8bd4ed06

    • SHA1

      c0dcc624e7b6f76a9ae1feb1522f81a00ae7aea7

    • SHA256

      6d921e6a65cc2eff0705ee661376acbce75d2c42c8da20ab193449751b8cdb98

    • SHA512

      52948868366c2d6c33817c7373eb1b86126aae34784310cd6c8acf74a2b948c2746bce6be24e1d6eda2bd3bcf58a18e241486f8aefd29aa3666d5309943b20e0

    • SSDEEP

      98304:6wgGItl3d5FmEuceDkC9H5m3HfTw/KLyz8m:/ID3n0gRfTw/oG8m

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Enumerates VirtualBox registry keys

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks