Extracted

• • Target
    1b592fc4c4ee4f6a0a536c129e65fcd6294e172f5c4a9893241a00c47f381391
  • Size 6.3MB
  • SHA256 1b592fc4c4ee4f6a0a536c129e65fcd6294e172f5c4a9893241a00c47f381391
  • MD5 40b98c4fc44df3f82b23e6d678cb6829
  • SHA1 28b403149b40e34783fb162805eef7baf6226fae
  • SHA512 5b0a8c49567598f2a5cc4c73f066bc9fd904e46984af0fa90da04011da94f5d125d0cceb2d0afe20885b86258c139bad3b79538812f8fd0ac6a86d7fe3f2ec55
  • SSDEEP 49152:rlkWPnAz2nxOhn46zaIGGJYzmhpGW8avFzt6KHEgi7Pb9S9zvDg0urR462UI:rLPndwh0GTfJh6KHEgi7Pb4ROrR46pI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptbotcredential_accessdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2