Overview

overview

10

Static

static

3

ca2a0cd089...1d.exe

windows7-x64

10

ca2a0cd089...1d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca2a0cd08981d9fe400184a043bf531d

  • Size

    663KB

  • Sample

    240315-b6tjgade6z

  • MD5

    ca2a0cd08981d9fe400184a043bf531d

  • SHA1

    3461b552394b7985cae6f726451487454155cd94

  • SHA256

    3b4d029184db5bdfd6185f67c08573dcac79eeb6462ecaceaa6327b78e70687c

  • SHA512

    08e3c62f188b31241e87f6e0d44d76d1d45f810089a0a9b9c522fc614264264053be67392cec59784e1433d9db7eddda5699742a91625fb77b518149be8cc72e

  • SSDEEP

    12288:51pkqdfZJm9pCess+P6o0d1jablVVJI5Mwg62meTWe7SIMP5Q:5hk9pCeZvAhIywghae7YS

Score
10/10
cryptbotdiscoveryspywarestealer

Malware Config

Extracted

Family

cryptbot

C2

ewawtm26.top

morzup02.top
Attributes
  • payload_url

    http://winqoz02.top/download.php?file=lv.exe

Targets

    • Target

      ca2a0cd08981d9fe400184a043bf531d

    • Size

      663KB

    • MD5

      ca2a0cd08981d9fe400184a043bf531d

    • SHA1

      3461b552394b7985cae6f726451487454155cd94

    • SHA256

      3b4d029184db5bdfd6185f67c08573dcac79eeb6462ecaceaa6327b78e70687c

    • SHA512

      08e3c62f188b31241e87f6e0d44d76d1d45f810089a0a9b9c522fc614264264053be67392cec59784e1433d9db7eddda5699742a91625fb77b518149be8cc72e

    • SSDEEP

      12288:51pkqdfZJm9pCess+P6o0d1jablVVJI5Mwg62meTWe7SIMP5Q:5hk9pCeZvAhIywghae7YS

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      A C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks