Extracted

• • Target

    979d1d97ef97c7ae5737a88e87757ec4

  • Size

    750KB

  • MD5

    979d1d97ef97c7ae5737a88e87757ec4

  • SHA1

    90d243cb67821975da1b13582476779eff5be9a5

  • SHA256

    d6255b4b18e6f07c4708cf6344163dfe3197cf403957bf3085a6a737bb37b038

  • SHA512

    05c60e3714d906ea985a923ebda9e2efca17dfe29bfe9169f8e14f7053dd2871d9fa6bafb1d56919c07041be8841cfba82811ac1868398e2587ca25433727b4f

  • SSDEEP

    12288:7RC0TWlTuoyPO3DwWUhREG4HR7cOIiatuSgw8ibKmYjoCM0G3Pll93USBfC:vWlTuzWNOiarzYjoj0G/ll9o

  Score

  10^/10

  cryptbotspywarestealerdiscovery

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2