CRYPTBOT

To gain wide visibility, the threat actors utilize search engine optimization to rank the malware distribution sites at the top of Google search results, providing a stable stream of prospective victims.

Visitors of these sites are taken through a series of redirections before they end up on the delivery page, so the landing page could be on a compromised legitimate site abused for SEO poisoning attacks.

실행 시 Autoit 관련 파일을 생성 후 실행하는 유형이다.

Because Cryptbot’s operation doesn’t rely on the existence of unencrypted binaries on the disk, detecting it is only possible by monitoring for malicious behavior such as PowerShell command execution or external network communication.

Red Canary shares the following four key points for threat detection: ... PowerShell or cmd.exe commands containing rd /s /q, timeout, and del /f /q together

The user becomes infected by clicking one of the malicious links and downloads either KMSPico, Cryptbot, or another malware without KMSPico.

The injection of the Cryptbot bytes into memory occurs through the process hollowing method

The injection of the Cryptbot bytes into memory occurs through the process hollowing method

The downloader includes defenses against reverse engineering and automated string extraction... To hinder automatic extraction, the last 6 to 8 bytes of each URL are append to the URL, making the string difficult to extract statically. | A new variant featuring enhanced cryptography was recently released... The only cryptographic operation in the malware is performed on the data returned by the server... The data returned by the server is AES-CBC encrypted, with the encryption key derived using PBKDF2-SHA1.

Only the main function, which is responsible for calling the curl API, decrypting, and loading the DLL, has its control flow obfuscated... the code is obfuscated using an extensive switch-case structure.

The adversaries install KMSPico also, because that is what the victim expects to happen, while simultaneously deploying Cryptbot behind the scenes.

The injection of the Cryptbot bytes into memory occurs through the process hollowing method

The injection of the Cryptbot bytes into memory occurs through the process hollowing method

Cryptobot checks for the presence of "%APPDATA%\Ramson," and executes its self-deletion routine if the folder exists to prevent re-infection.

This installer then launches a script that is also heavily obfuscated, which is capable of detecting sandboxes and AV emulation, so it won't execute when run on the researcher's devices.

When the directory exists, the binary generates a random number and performs Sleep for that amount. It is assumed that delay execution is done to bypass detection.

When the sample is deciphered, the DLL is manually loaded... 'Failed to load DLL from memory'

It functions as a stealer malware, capturing sensitive information like login credentials, browser cookies, and cryptocurrency wallet data.

It functions as a stealer malware, capturing sensitive information like login credentials, browser cookies, and cryptocurrency wallet data.

Threat actors are distributing altered KMSpico installers to infect Windows devices with malware that steals cryptocurrency wallets.

CryptBot malware steals infected PC’s information as well as various user information and sends them to the server.

This installer then launches a script that is also heavily obfuscated, which is capable of detecting sandboxes and AV emulation, so it won't execute when run on the researcher's devices.

When the directory exists, the binary generates a random number and performs Sleep for that amount. It is assumed that delay execution is done to bypass detection.

각종 브라우저에 저장된 계정 및 패스워드, 암호화폐 지갑 파일, Discord 등의 메신저 토큰, FTP 클라이언트 정보, VPN 정보 등 다양한 주요 정보가 탈취 대상

Among others it steals credentials for browsers, crypto currency wallets, browser cookies, and creates screenshots of the infected system.

The file downloaded from the distribution website is a ZIP compressed file. Inside the file is another ZIP file that contains encrypted malware and a text file with a password.

Because Cryptbot’s operation doesn’t rely on the existence of unencrypted binaries on the disk, detecting it is only possible by monitoring for malicious behavior such as PowerShell command execution or external network communication.

The trojan downloads and executes three files from a public Bitbucket.org repository to %APPDATA%: 1.exe, 3.exe, and 4.exe.

The stolen information is then sent to the attacker... begins data exfiltration.