Extracted

• • Target

    49df1f993baea2dde87a7723cce4d16e4e761730d5f00173af472e4fd67cfd97

  • Size

    6.3MB

  • MD5

    80cbe687002f14859f172e5530d26114

  • SHA1

    4873c15fcb8a318d44e56c0c910ad2a33355a052

  • SHA256

    49df1f993baea2dde87a7723cce4d16e4e761730d5f00173af472e4fd67cfd97

  • SHA512

    ab87fe943afcfc868a5648179569c4b8a7cb737f310aa6a6c599abeca0b4f1ce530fc89bb1db91b8b5124dbc46803e2d1753243f49c5ff97b0e856cbbf42bcdc

  • SSDEEP

    49152:UY6vRH/p5aNGWP7iV1KbEomLIhXVpY2Svs8mpRw2OqF6BwhHti4l4+YC8lKqn0hI:Qt+Lbvc2Svs8mpRwzqFMwAr95iNytV

  Score

  10^/10

  cryptbotcredential_accessdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2