Extracted

• • Target
    b016187f2f4b23b676b6e7d21b2be6c1
  • Size 1.3MB
  • SHA256 1d07bf7984822e6421852a7ce61b765f344fd7cc7ac8597ef91a00bf4c55d8cb
  • MD5 b016187f2f4b23b676b6e7d21b2be6c1
  • SHA1 81afd90ef5279af3f92e9bdcbafdd35f7775e928
  • SHA512 b5fa40f388307eb48068eada8b8bce14ac6bae5868f21526052661ecf2ab5113d4ec69b22f1089cccdf9447fb405494806de21f0840800b53175519199cb7b1e
  • SSDEEP 24576:Ado2Ir16CtHXxaZ22QJtJ+xhxs1Vl5wqAuq7Cf/QX7dvE192/y:5FuPQJtgxs1VlAt7CfmZvE19u
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptbotdiscoverypersistencespywarestealer

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2