Extracted

• • Target
    d5f23f8aba4d574b840365ac6d03bc64.exe
  • Size 771KB
  • SHA256 958bf791886caad7744fe007df2e3134e1f0260b9c86bbc87d42a42ca69c87ff
  • MD5 d5f23f8aba4d574b840365ac6d03bc64
  • SHA1 2b97cb3bc8135ec8ea649ff01cbe5614a89cdd26
  • SHA512 d97c0835fa5a8500846ae7805644bb4d47907515e93b3e1929c0943a8873f3d405027b5175905c652e3ddfeb36f8232ecb34d98808a55b9b78ca1cdf18917af4
  • MD5 SHA1 SHA512

  Score

  10^/10

  cryptbotspywarestealerdiscovery

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot Payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2