Extracted

• • Target

    357ef9cb624718fe978e70761284731ab2e7d5b3ae278b72de36faa14ba7a3f9

  • Size

    6.4MB

  • MD5

    72a36013b0437771e94ac5d6619a6e5d

  • SHA1

    3226a5508f512a924d3f728303b86b897b45097e

  • SHA256

    357ef9cb624718fe978e70761284731ab2e7d5b3ae278b72de36faa14ba7a3f9

  • SHA512

    effad2a41d9020ffb02e2c5e3baa430ee69fa9b2edb9ff17a65c7bd12dbf8a8fe6dc61f76fa5c9650280be3f861704977b8c8c443fb51d2f4a924998bf74550f

  • SSDEEP

    98304:+9FGLVBZIKvrkC0/bgahzSlyoMD0YZR66mTB:+P+VDIKzkC0phzR0YZYTB

  Score

  10^/10

  cryptbotcredential_accessdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2