Extracted

• • Target

    Pass-55551_NewFileV3.rar

  • Size

    5.4MB

  • MD5

    b4273a57d910afe2573782b3be8ae7d7

  • SHA1

    37bed27da97e64e9337e21714db92f9c6ac2e222

  • SHA256

    5154e8b32a016e05675f20c98d523681aa887e180c1fde2a10fc0007e3023bcc

  • SHA512

    cfaa4efea16d8a9d3211821ed6de180e7e0ec86883d951e87dd427facda125b35c70f005365bd44a9da4f5e4b3f862762782809671f8166b655b35dc42c65824

  • SSDEEP

    98304:aIssSDsYqxJ1USRnGc9b2fGAlg/o1V5Qo6+OCEFv1AlKBjDByJp3CHO:pnbYG+S1t9sGAlg/4VTnEFdAlKTul

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2