Extracted

• • Target

    437EF2554163F1A5741638AEED6B5B91.bin

  • Size

    703.5MB

  • MD5

    437ef2554163f1a5741638aeed6b5b91

  • SHA1

    de659aa13c6795fd44e02d9f22daa1c9d822dfeb

  • SHA256

    b118c69d60c43222ba733d70d620948c22662c100fa1430a543ffad529775246

  • SHA512

    6dab3efc1f095ca272f06ea8cbc09b11bd32f38e54bc7fe09caf7d30a1622a09aa4b428de747ac183791ffd31c87a5e846800e36fbd48a2281ff6de90a030d2a

  • SSDEEP

    98304:EEjzOuKs39I1sBdGYZ26y3SWGoqZ92yVG/u:EEW/IVDMVByQyVG/u

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2