Extracted

• • Target

    d0b6908336ed7ec21717798aa2c451170bddc97c33e263ee356fec4bf3eee1bd.exe

  • Size

    6.4MB

  • MD5

    11dff4157b31de7105a8c859591da583

  • SHA1

    0ad03dffbe102a61b7c2ec820ee19f61e35b27cd

  • SHA256

    d0b6908336ed7ec21717798aa2c451170bddc97c33e263ee356fec4bf3eee1bd

  • SHA512

    6248f3b3e4cfaed691f45609cb0b17ba8e0c5911bda96ff3e622ac6cc7546b1543575173ef34fd2ffe856bc598da1473fa15bdb8686c0d785310620ecaf7aaf8

  • SSDEEP

    98304:02e5eRz8i5DPnORP64YkhY0Oyl419PPIm/iPB7:ne5m8i5DmEOhqyli9Ph8B7

  Score

  10^/10

  cryptbotcredential_accessdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2