Extracted

• • Target
    9c246376b276edf4bd3800999bcdbd8b
  • Size 1.4MB
  • SHA256 e7c90c063390ac4ea029710361c1f701a7e0ce3c7ac48c0200b2c0a40d556844
  • MD5 9c246376b276edf4bd3800999bcdbd8b
  • SHA1 baaa4ee8d86277ce9b4c2e8545f26b8ec4214ff5
  • SHA512 61deb8ba8ede3250605bdb6a893cdfe16aae7a93c2da05fb74976a79c443b4b3c39255e8c0fbdc04e9bd69b67516efa5973efc04283e7118eefa4552fbb48734
  • SSDEEP 24576:/0bsPpigjXnPv9IhXZ4h8yEHgFctZgBMOp9TIkgkjUicrFXlo/cwVI9Vt:sbsPZXPlaOyyCqctZgx9WrIcV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptbotdiscoverypersistencespywarestealer

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1
• • Target
    Afa.xlsx
  • Size 759KB
  • SHA256 9a67ec53e2cf2856c0f768ec8d841b9ce525d637c6280c24bbd3dd02caaf55a6
  • MD5 336d83f68ac29b0d8c9ed1114687c974
  • SHA1 6f2f555b2c36c25e1374dcaf948d75a2ff715e19
  • SHA512 ca4713b47f4dcf5f226e3355663407107096e0e26c186bf64c42e81dcbd582ab8491e2e64cf1ba6fa17f0bbfdd0204269f6bf4523642e6560bed5e6b3c7076c4
  • SSDEEP 12288:L78Tr0Vicsd//ss35qEzNz7V8X2Z/7sb6jvIP+oW0Wpji1u3wV9+mm:fw0A//rx8X3j1YF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral2behavioral3
• • Target
    Animazione.xlsx
  • Size 634KB
  • SHA256 8480e8b274304c1bebe3032462cb88be0cf344bb674b2941ec1f759f4363500e
  • MD5 e76cefed6bf0853d0bd3ebd47c6c0b54
  • SHA1 9efee9e1530f088dff1cab38d2d858c3caf66689
  • SHA512 795b902c0aecef5e54dcaa4f8f78c970f8c2482e5712f1961d5e8b6b3c131d2e8fb1a64b8d0bfc6a791cfccc884242d07517a7bc9597c8588f7088519d09508a
  • SSDEEP 12288:p1QdMKMOo36T9rYfspTkRUlZYDtVrFk2ouk4/Ynn3IzJIV7/X2:3eNMOM6TB9FkRUW3rFxC4/cY9IFv2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral4behavioral5
• • Target
    Ero.xlsx
  • Size 412B
  • SHA256 4c409b1fb0512232196d4736419684137aaf0381db2a374ed0bb8f7f8845cc95
  • MD5 be0eecba29d212cb8fa794f6cdc410a9
  • SHA1 fd80987ca6bbb3c2979672ec50c027387f92f13c
  • SHA512 8482d89e41743a4104f65324659203b8fed6831b94df148e8e15f73d9b4b3de57c08b6ea40e924f41eca8d42d4d559e0470763872ea6a023884a7cb720c35597
  • MD5 SHA1 SHA512

  Score

  1^/10
  behavioral6behavioral7
• • Target
    Mossa.xlsx
  • Size 872KB
  • SHA256 cec4425082b020a617714221ab542c8585dc481195242d681a9436fe8e1a388a
  • MD5 b3818489c206e21ff4b697f419754a56
  • SHA1 f8e4ff07615ce4ba12755a0fad4c5a462e2316bc
  • SHA512 5139b0d80c10610082845448ce5cf3a18d78d6e326bb11295d7fb295ea94d1c1ea7b946650287cd3f1cef85400a6fc84be75b48f551bbddc1c529fe3815b261a
  • SSDEEP 12288:kpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:kT3E53Myyzl0hMf1tr7Caw8M01
  • MD5 SHA1 SHA512 SSDEEP

  Score

  1^/10
  behavioral8behavioral9