Extracted

• • Target
    Setup.exe
  • Size 304.4MB
  • SHA256 e58df6719823d607f8df583b55f35c5413241d902459e7f3375108b4bbd88ca1
  • MD5 c94520851f6f59a49c84ccfbbddea45f
  • SHA1 5e66151836e834877df6b2465c8c5cb8d610c384
  • SHA512 47c275ae16f4cdd70703fcfdab8a05a3915674556abd966a77d834df168339544ccd9614f4c0500e98cedb7be635e8d191ba94dff947ddf2f12e6ac2ed6306ca
  • SSDEEP 98304:aTL/DFjb0CjVM03jwRR6lngPaNe4/wsr6kcXv69PvQP1:ArFjoCxM03sKcHsJcQvQ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2