Extracted

• • Target
    ed19ea12ee52a2dd4808b6956b9e65524fe0307659e685253ad3b28df0ef89e5
  • Size 6.4MB
  • SHA256 ed19ea12ee52a2dd4808b6956b9e65524fe0307659e685253ad3b28df0ef89e5
  • MD5 931c65c2abf6031d6520f1a48a0f5e34
  • SHA1 e5034aa393e00a2b217ad7d60aa49362b6ba5fce
  • SHA512 f8deb851b0c4e405d116cb8fe75e952716fadee1fac63dc38ff2f02fd6590a3dbe0aab74022fc2660874ef9c5950c7bfe113672b61f419b62e865db8da55b415
  • SSDEEP 98304:6eZyvLAWn165UTJbRIQT/diMjl1jWQsznI7:6eZyvLAoLtRnzl1jWbI7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptbotcredential_accessdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2