Overview

overview

10

Static

static

10

start-this-641.exe

windows7-x64

10

start-this-641.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    protochordate-archsee-3328.zip

  • Size

    2.8MB

  • Sample

    250208-tdd77avpam

  • MD5

    79be208973529d762d9d5c6067f42ea3

  • SHA1

    106529b03fc078a64ef65ddf53bc98fe949933d0

  • SHA256

    a1b292bb3f8ea1e913d58b7f58344582692f3142d3426f0d0e2eaa563318f945

  • SHA512

    f6858a1edd03291ced0dcc0e11cf19dea2b8be4d6c955ae9ca56e4b63e8017ee333565d4cfea04279268b3aebfcfeb9699d489ab27a211a6a620a950a5ac223d

  • SSDEEP

    49152:XI5CXNVKujWmRNkFnExstvn2zlWawVhk76Gt7ZniPmlvp2Rj/BaiHHffwrIqS84C:YYXNVKgkFnTtvk1wVgXBpl4jnnffwr5V

Score
10/10
cryptbotcredential_accessdefense_evasiondiscoveryspywarestealer

Malware Config

Extracted

Family

cryptbot

C2

http://home.thrtpp13sb.top/raOzktqqsOFBfTfWPzPd11

Targets

    • Target

      start-this-641.exe

    • Size

      9.2MB

    • MD5

      5e3f27e33382bfe00dff755de6419aac

    • SHA1

      12a9ffa0fb4610a1e2b8f5c06b8bb866b9a74467

    • SHA256

      ec0d356acab765845f3a575925bcf37bb123d9e31a7d715a40ab9a45c8ab9747

    • SHA512

      d9b461c18437950cbcfe9b37d90bff93b98c7842cfb5ec28af3a63b604f22751bd60d726df76abbd6b906bc60ce387972aa3057d2e1ac32666eb0c48e0577bc1

    • SSDEEP

      49152:hBh2PlCepkkx97IcHPcUclr4p5vcJffAdZXiwdZvuBWkhcscqqKlbrHPyz8AY/Fh:h7kwkxFH0UrbcVf6ZSwLu8VKVyz8D

    Score
    10/10
    cryptbotcredential_accessdefense_evasiondiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • Cryptbot family

      cryptbot

    • Detects CryptBot payload

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealer

    • Enumerates VirtualBox registry keys

      defense_evasion

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

1
T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

1
T1556

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Modify Authentication Process

1
T1556

Steal Web Session Cookie

1
T1539

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

4
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks