Extracted

• • Target
    8d854838208356a93256d723a35af478
  • Size 304.4MB
  • SHA256 9b6bca999c22441881b3c13fb886519a2a69e4c35092fe535b533d0d0cd350aa
  • MD5 8d854838208356a93256d723a35af478
  • SHA1 8255c40cc57af9f3bff8708b6c1f9ed3078b496c
  • SHA512 fab23cc13e3fd8e636681b43fac1513f1181cd223914e79e7374149f4984c576c8b3f199d894b4c29d2ae4e8cd99aab614835351ff9f013f1dd48d65a540703a
  • SSDEEP 98304:LahKoy5B3h1JzGP0hZsYA7DC6qmFfCVQ42+SMWNxJ7/nAT:qKp51JzcEq+6q8fCGnbP3JzAT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2