Extracted

Extracted

• • Target

    SecuriteInfo.com.Troj.Kryptik-TR.832.4367

  • Size

    746KB

  • MD5

    8d93b4ca20dea336647b556294a36ab4

  • SHA1

    f4c3c4e89f53676b7b88280fdf37dba5a237d047

  • SHA256

    8a76004d1a369fe370c6427a17869a59844c131ac485ac7577a41df8f61d13f9

  • SHA512

    8afbe6e21fda9c43ac2337bfc45cf1a3867cd4dd48e076584f23b24ed25908b7d057ae6a824929aabebc98d4832585b329e285045b2eea449f1509f19b91c2e6

  Score

  10^/10

  cryptbotspywarestealerdanabot3bankerdiscoverytrojan

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot Payload

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2