Crypt32Malware
ransomwareFrom MISP Galaxy
Last reported 5 months ago, by Huntress2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“…alf.org, RC4-decrypt with the per-task key, unpack client32.exe from the ZIP, write to %ProgramData%\CeoliauD\Dabkina, register as a Scheduled Task with logon trigger so the payload runs on next login, and capture a desktop screenshot for exfiltration.”
- T1055Process Injection
“TTD process injection”
- T1055.012Process Hollowing
“…rmally free, but the loader is willing to unmap a legitimate module to make room for the payload if it has to - that's a flavor of process hollowing.”
- T1543.003Windows Service
“Interestingly, the -initialize flag also hinted that TTD could be deployed as a Windows service.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
ClickFix Removes Your Background but Leaves the Malware“That's how the binary reaches into iphlpapi, crypt32, winhttp, wininet, and other Windows System DLLs without any of them appearing in its declared imports.”
-
Deep dive into the TTD ecosystem“…ining a handle to the process to attach to ([2]), the function resolves an exported generic function used to perform string operations: crypt32!CryptStringToBinaryW.”
Indicators in its reports
named in the reports above- ai-scan[.]digitalin 1 report
- bg-transparency[.]onlinein 1 report
- cheeshomireciple[.]comin 1 report
- hxxps://trindastal[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/loc8in 1 report
- trindastal[.]comin 1 report
- hxxps://trindastal[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/v8in 1 report
- hxxps://trindastal[.]com/8250d149-9bf8-566d-9d7d-ea925eae0a4in 1 report
- f5dbaa09e60343f2…3744e3c11febin 1 report
- 38.146.28[.]30in 1 report
- bde21d8be65d31e1…fdf6c3768c92in 1 report
- ed391a16389234f9…b7d0565d7fb9in 1 report
- hxxps://trindastal[.]com/8250d149-9bf8-566d-9d7d-ea925eae0a4c/in 1 report
- hxxps://obelnamevalf[.]org/OaTS7yE9zd/defaultin 1 report
- obelnamevalf[.]orgin 1 report
- hxxps://brionter[.]com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/net40.binin 1 report
- brionter[.]comin 1 report
- bg-go[.]onlinein 1 report
- background-off[.]comin 1 report
- bg-ready[.]onlinein 1 report
- bg-removerok[.]onlinein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.