cryptbot

General

Target

5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82
Size

4.4MB
Sample

220725-exrkaseehp
MD5

3f17a33300b3611e055c29ff101021bb
SHA1

ec963dc4cbed5fa5c3a72711dc56c3a75abbfd0f
SHA256

5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82
SHA512

d08929039416e57477f8d5dc70e7618c3a2b08c613d5bc58452f68e69acfef96db7f74d72d842a008e754ed21518c74cf8f864078f979434b3c0f17b75529f5f

Score

10^/10

Malware Config

Targets

- Target
  
  5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82
- Size
  
  4.4MB
- MD5
  
  3f17a33300b3611e055c29ff101021bb
- SHA1
  
  ec963dc4cbed5fa5c3a72711dc56c3a75abbfd0f
- SHA256
  
  5b0a1b4bad2c6455d328b5ade2d88dfa5eb6d56f344200941259437a86836c82
- SHA512
  
  d08929039416e57477f8d5dc70e7618c3a2b08c613d5bc58452f68e69acfef96db7f74d72d842a008e754ed21518c74cf8f864078f979434b3c0f17b75529f5f
Score

10^/10

cryptbot discovery evasion spyware stealer suricata
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
  suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
  suricata
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Blocklisted process makes network request
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2