cryptbot

General

Target

YouAreAnIdiot.zip
Size

223KB
Sample

230402-m6kr4shc6w
MD5

a7a51358ab9cdf1773b76bc2e25812d9
SHA1

9f3befe37f5fbe58bbb9476a811869c5410ee919
SHA256

817ae49d7329ea507f0a01bb8009b9698bbd2fbe5055c942536f73f4d1d2b612
SHA512

3adc88eec7f646e50be24d2322b146438350aad358b3939d6ec0cd700fa3e3c07f2b75c5cd5e0018721af8e2391b0f32138ab66369869aaaa055d9188b4aa38d
SSDEEP

6144:M9iMNCHRNLhitoVak4jaChlNY4SWn0m3/ottG+DM:7IURthAXk4jBhKWl3/otc+DM

Score

10^/10

Malware Config

Targets

- Target
  
  AxInterop.ShockwaveFlashObjects.dll
- Size
  
  17KB
- MD5
  
  451112d955af4fe3c0d00f303d811d20
- SHA1
  
  1619c35078ba891091de6444099a69ef364e0c10
- SHA256
  
  0d57a706d4e10cca3aed49b341a651f29046f5ef1328878d616be93c3b4cbce9
- SHA512
  
  35357d2c4b8229ef9927fa37d85e22f3ae26606f577c4c4655b2126f0ecea4c69dae03043927207ca426cc3cd54fc3e72124369418932e04733a368c9316cf87
- SSDEEP
  
  192:S0wBqUkWkzIeKiSOmIeuY0w9Dss+gcqEOsWaCludy0LC79roU5mvcBEx5xdQy0Y3:sdOLSr95mvQyT+E746F
Score

10^/10

cryptbot discovery evasion persistence spyware stealer themida trojan upx
- CryptBot
  A C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Sets file execution options in registry
  persistence
- Stops running service(s)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  
  Interop.ShockwaveFlashObjects.dll
- Size
  
  21KB
- MD5
  
  e869d1d4545c212d9068a090a370ded3
- SHA1
  
  a6a92f108bba390cd14e7103ba710efec1d270f9
- SHA256
  
  63af704211a03f6ff6530ebfca095b6c97636ab66e5a6de80d167b19c3c30c66
- SHA512
  
  ee108b0ebefb476c5beb568129da7ce058229fb42ad3500c6fc37a36d718eb67a17b331d73f6920a5290c3977be2eda96aa057533c3344898d161cb464c6ef76
- SSDEEP
  
  384:7wXx47rQdtuc51hDDttTtN0HUSZs0HVX/1q++d8:P7UdTDDttTtNTy68
Score

1^/10
behavioral2
- Target
  
  YouAreAnIdiot.exe
- Size
  
  424KB
- MD5
  
  e263c5b306480143855655233f76dc5a
- SHA1
  
  e7dcd6c23c72209ee5aa0890372de1ce52045815
- SHA256
  
  1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69
- SHA512
  
  e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113
- SSDEEP
  
  6144:XgasGR5rnK2Qh9lp2E9ThHZmnRRQh9lp2E9ThHZmf:XgasmWrjJ1ZmwjJ1Zmf
Score

3^/10
behavioral3