Extracted

• • Target

    Device/HarddiskVolume1/FileHistory/[email protected]/LTP-566/Data/C/Users/SreejithKumaya/Desktop/New folder (3)/setup (2020_09_08 06_33_12 UTC).exe

  • Size

    3.8MB

  • MD5

    0afb947cb776933653e23d970a3d8d14

  • SHA1

    c8ab072395450ae11a6abf5323922d74c180d24a

  • SHA256

    ad08c7d20f5342efc20b4460ad66b0961a423804915012ab2969efe25e1288b5

  • SHA512

    ae031402db52a167e6754bf9c04b3f810ad0e2e1202349141f878dc89de6ad1fbfb586d1ef8aee3ca79efa70539dc18ec2da7ca74e3255c01e9956f57d987dc0

  • SSDEEP

    98304:zdh4mx3ywXIaszDU5j5eXOUvlDYL5JZNKdSC7ZUY6NsOoWNCCy9R:zP4s3hXIan5e+UNiuF7INNoWdyn

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Blocklisted process makes network request

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2