Extracted

• • Target
    library.exe
  • Size 3.4MB
  • SHA256 f1d76f93fe7eee3f845d8b849054d5f268616734c10c941977c5b3e3017a295c
  • MD5 b8e6896a668b771a44216c86d6b80626
  • SHA1 8bffd445519acabbee5fefc45f3d6710ef9cb8fc
  • SHA512 1f3a49c6818edb57e0bb8315889e702abea39a3c3eb2965d7e59c5b4ced59b7a7f1ac9ffb7b6424f6ae1c5cb5b65a2c5e2cc2958180c83a87a2953143d9b1a7c
  • SSDEEP 49152:KxBZS8lNrXHTkE/RToUvF/lV0GyQaXq9vSetWpEyyt7O7Ps:Kx/lNr3TbekdV0Gy9X1eyUaT
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealerthemidatrojan

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Executes dropped EXE

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2