Extracted

• • Target
    631defcfe435bb021b408b39bc9130cc351d698791172f6c9db6050cf3db1702.exe
  • Size 6.6MB
  • SHA256 631defcfe435bb021b408b39bc9130cc351d698791172f6c9db6050cf3db1702
  • MD5 238509ed1c8581aae3e57ea7de78ffd2
  • SHA1 72f5e44557541019d1303533c0063b1a739872ee
  • SHA512 d9e396e5a1f7ab3050fa551fde087e4567e935340e119dc77df063af994229be0f84174fa2551f004c52aa16d37091899142b18c869e9a7a90edebfe8ebe7162
  • SSDEEP 196608:V0VBjQzX+gwvGJYwSRMBu+oKyV+r05N4+K/:KceGSNebyUQEt/
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2