Extracted

• • Target

    1f707d3f1244648ef647d03e92980b721b105215117b8db2392082adf14a22c5

  • Size

    6.3MB

  • MD5

    c9f0d3e4b343ef9581b35d5fd2b1e302

  • SHA1

    2336b4e27962cf4ec268b03e15d62cff4196ff54

  • SHA256

    1f707d3f1244648ef647d03e92980b721b105215117b8db2392082adf14a22c5

  • SHA512

    293e4fc97479908ed2b0d37d44a71b36148abc648af23f38355ab96840eda6d6280682b867656a76ba6c9a025d1f57578d21daeeab7d13d4b1bbba7ff8dca45b

  • SSDEEP

    98304:uVcNJAD2BvEvpyB75ftFOC+HmOMBdRFqHl:umJ22BvEvU3ft4DHm53bqHl

  Score

  10^/10

  cryptbotcredential_accessdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2