Extracted

• • Target

    4b6be11fd5704e5489c7911c1659f1bb7f9901e2d5c70c2f8f126512071093cc.exe

  • Size

    6.3MB

  • MD5

    d033249a79f6c6296cd62fe03a185acd

  • SHA1

    b481dd69262bf6423ce909d7d8777368fbfdf369

  • SHA256

    4b6be11fd5704e5489c7911c1659f1bb7f9901e2d5c70c2f8f126512071093cc

  • SHA512

    d7ebb63c82f16177400a6aecbdac514a205264722cfb45b643f74231209ee3b8df7813663711b5efe3287ed180e810ac74370244c7308e6e18e76e095d37b657

  • SSDEEP

    49152:lwlwpSGtoLZftvEe/imXDh+VkeK29ZfarzEDNUyXNmGYrK9JI+Nop:LIqoLdtce6mTh+VXKGIVyxAOop

  Score

  10^/10

  cryptbotcredential_accessdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2