Overview

overview

10

Static

static

10

ec0d356aca...47.exe

windows7-x64

10

ec0d356aca...47.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec0d356acab765845f3a575925bcf37bb123d9e31a7d715a40ab9a45c8ab9747.zip

  • Size

    2.8MB

  • Sample

    250208-s2ryhssphz

  • MD5

    d76d018baef0f25791688e77dd03af9c

  • SHA1

    7e5fa4817f638a3eefc8c6f61a76c06fe8d65e12

  • SHA256

    ac9b2892adb15e36b51d8e8e4715f55cdaace5c55bf156c0b47cf3cd36e2e64b

  • SHA512

    7136cc2e48c29481ad933a4946bab8c0dc04f146ba1c9ef8806737429f577139244d024085ad73f703d765696faee071c9156e5d4814780c22e728804764e6f1

  • SSDEEP

    49152:N4Rp+AM5hkjtAgdcMGZDe7okgdUKvfgD1JhvrGpxTkGjv1fweb4+xHSngIGgU3VF:eRpA5hsAvDxkuHgJPvraRYeb4oCug0ww

Score
10/10
cryptbotcredential_accessdefense_evasiondiscoveryspywarestealer

Malware Config

Extracted

Family

cryptbot

C2

http://home.thrtpp13sb.top/raOzktqqsOFBfTfWPzPd11

Targets

    • Target

      ec0d356acab765845f3a575925bcf37bb123d9e31a7d715a40ab9a45c8ab9747.exe

    • Size

      9.2MB

    • MD5

      5e3f27e33382bfe00dff755de6419aac

    • SHA1

      12a9ffa0fb4610a1e2b8f5c06b8bb866b9a74467

    • SHA256

      ec0d356acab765845f3a575925bcf37bb123d9e31a7d715a40ab9a45c8ab9747

    • SHA512

      d9b461c18437950cbcfe9b37d90bff93b98c7842cfb5ec28af3a63b604f22751bd60d726df76abbd6b906bc60ce387972aa3057d2e1ac32666eb0c48e0577bc1

    • SSDEEP

      49152:hBh2PlCepkkx97IcHPcUclr4p5vcJffAdZXiwdZvuBWkhcscqqKlbrHPyz8AY/Fh:h7kwkxFH0UrbcVf6ZSwLu8VKVyz8D

    Score
    10/10
    cryptbotcredential_accessdefense_evasiondiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • Cryptbot family

      cryptbot

    • Detects CryptBot payload

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealer

    • Enumerates VirtualBox registry keys

      defense_evasion

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

1
T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

1
T1556

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Modify Authentication Process

1
T1556

Steal Web Session Cookie

1
T1539

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

4
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks