Extracted

• • Target

    9a75a6d3afd26306f563d96dc2517225.exe

  • Size

    585KB

  • MD5

    9a75a6d3afd26306f563d96dc2517225

  • SHA1

    fadb011bcecdd3919242b4019d0746772ac48ce6

  • SHA256

    574afcec719331221014fefc45e623e57ff81468b21fcbc186fa7f448be48a40

  • SHA512

    3ee3787329425f3e71b507d58b84797df54f82e535e23b146a3185e892c93628daec0e9fe6fd3d64bef50ec4e1f378e93c45fd38ae3e11aafd6c4f8bfff56782

  • SSDEEP

    1536:6aRU9m4HYvSIX0u+7+j71iMs5gU5OuTcjCNON9PApdpihLNafpo:kOhX0N7+f1iV5bcj0wWduLIho

  Score

  10^/10

  persistencecryptbotdiscoveryspywarestealer

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2