cryptbot

General

Target
a26ad0702fa8eb51a2e8337372bf1718383060c24979242e505dcf915b01fb1c
Size 2.8MB
Sample210511-tvaxm2baps
SHA256 a26ad0702fa8eb51a2e8337372bf1718383060c24979242e505dcf915b01fb1c
MD5 5acbc07010e56263682b0a59f0005794
SHA1 a9bbf6ea962979daebeceab63d27a37a3c32e5ac
SHA512 c398af2f5e7020f4be17d36c9c2a57090f23ad73c86079df4db414157397ed48fa3195335dec7964fb91a74fa4728c995a4594bb1463ffb18b57b5e6d32a2d31
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  a26ad0702fa8eb51a2e8337372bf1718383060c24979242e505dcf915b01fb1c
- Size 2.8MB
- SHA256 a26ad0702fa8eb51a2e8337372bf1718383060c24979242e505dcf915b01fb1c
- MD5 5acbc07010e56263682b0a59f0005794
- SHA1 a9bbf6ea962979daebeceab63d27a37a3c32e5ac
- SHA512 c398af2f5e7020f4be17d36c9c2a57090f23ad73c86079df4db414157397ed48fa3195335dec7964fb91a74fa4728c995a4594bb1463ffb18b57b5e6d32a2d31
- MD5 SHA1 SHA512
Score

10^/10

cryptbot discovery evasion spyware stealer themida trojan
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2