Extracted

• • Target

    Set-up.exe

  • Size

    6.3MB

  • MD5

    4c83bca25969c07f28c783d72a2d9235

  • SHA1

    796ee5f126d2ea5d4c795fdb4c02190226f91705

  • SHA256

    1d60db87501f760576e6b8b9f0213a25d37025fddc020be1f63790e29b7cffb2

  • SHA512

    ca322ffdd38bc28eb1aae82d88d1b1c52a2bf52b171e2f404db19994063a32e017968853f0a87832c28aaeb542018bbfaef365122de1237281516e709db57524

  • SSDEEP

    98304:oeDWRfe84U/v88b43JsniWcTRP+GmBAGyC:oeyRfeS/Nb43JsiWSR2T+GyC

  Score

  10^/10

  cryptbotcredential_accessdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2