General

  • Target

    c3c559e832052bbf33f52f6f8b0ff086

  • Size

    701KB

  • Sample

    240312-tgrmpafb85

  • MD5

    c3c559e832052bbf33f52f6f8b0ff086

  • SHA1

    23477b75572d17b1d47b9670862aa174fb55d166

  • SHA256

    838edfe6cbf7b8fb1f0d3d99535f15ef22b651fa82a9f31a50c3cae435a0af0c

  • SHA512

    2a1e3e9676b103d23947b2271059f59f0bd71559071805f8650c6a27168016cff791ec3c7f2102740b1e1b9a6c5f34775a9a58d2ae3215f9bf386827d9da4583

  • SSDEEP

    12288:2mSxZQAOMrb0dAmfaRyCeBroJrL4ydQGgjSRClCgABPAi:2mPAOMcd2y5Z6rL4v59QBPA

Malware Config

Extracted

Family

cryptbot

C2

smauvo62.top

mortuh06.top

Attributes
  • payload_url

    http://gurswi09.top/download.php?file=lv.exe

Targets

    • Target

      c3c559e832052bbf33f52f6f8b0ff086

    • Size

      701KB

    • MD5

      c3c559e832052bbf33f52f6f8b0ff086

    • SHA1

      23477b75572d17b1d47b9670862aa174fb55d166

    • SHA256

      838edfe6cbf7b8fb1f0d3d99535f15ef22b651fa82a9f31a50c3cae435a0af0c

    • SHA512

      2a1e3e9676b103d23947b2271059f59f0bd71559071805f8650c6a27168016cff791ec3c7f2102740b1e1b9a6c5f34775a9a58d2ae3215f9bf386827d9da4583

    • SSDEEP

      12288:2mSxZQAOMrb0dAmfaRyCeBroJrL4ydQGgjSRClCgABPAi:2mPAOMcd2y5Z6rL4v59QBPA

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

    • CryptBot payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

2
T1005

Tasks