Extracted

• • Target

    dd2cb882d1c389c64e7648022451ddb335279ffe4564bafa932cc673273ebd29

  • Size

    2.7MB

  • MD5

    a5aafab67dfcad2fae7b85c7bcccbb5d

  • SHA1

    59cb807951956f1c62e4cfb355d5529de0ca729e

  • SHA256

    dd2cb882d1c389c64e7648022451ddb335279ffe4564bafa932cc673273ebd29

  • SHA512

    f21a00af7021f137e6336e4a9597239ecfb57ce77dd6888a3215e282de0b53b2690456e0e471a7a65339ef397767a27f762b5ad2f4a6f4356ef04ff809f3af3e

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealerthemidatrojan

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1