cryptbot

General

Target
a56a438d296e4d5ec107afb712040699ea02193eb66da7b75824af11566d45a7
Size 2.3MB
Sample220724-v5bf2scfe8
SHA256 a56a438d296e4d5ec107afb712040699ea02193eb66da7b75824af11566d45a7
MD5 6436038f39ee60665d8039872740d6e1
SHA1 c004ab28fcc247788176ea0e723c66b8f97dd335
SHA512 e605513ef092c17de8309011e48c1920889f386ab1220c10b386b44ef7eaec606a5a50986e48b5dd3b68c019660acfb9e58c9089b5cbe8a6d019bf62129e5f84
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  a56a438d296e4d5ec107afb712040699ea02193eb66da7b75824af11566d45a7
- Size 2.3MB
- SHA256 a56a438d296e4d5ec107afb712040699ea02193eb66da7b75824af11566d45a7
- MD5 6436038f39ee60665d8039872740d6e1
- SHA1 c004ab28fcc247788176ea0e723c66b8f97dd335
- SHA512 e605513ef092c17de8309011e48c1920889f386ab1220c10b386b44ef7eaec606a5a50986e48b5dd3b68c019660acfb9e58c9089b5cbe8a6d019bf62129e5f84
- MD5 SHA1 SHA512
Score

10^/10

cryptbot discovery evasion spyware stealer
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2