Extracted

• • Target

    7febc09c97d078d9617d71db6c6c41ed7f81fd332a01b7683108c453661d3ca8

  • Size

    6.3MB

  • MD5

    ae1c38b2c0209f39d1c5d544e5a5ecf7

  • SHA1

    7cc8c38efb8a3c4b2a858aa959a9337871e175a3

  • SHA256

    7febc09c97d078d9617d71db6c6c41ed7f81fd332a01b7683108c453661d3ca8

  • SHA512

    e65130829ad0837b5fb8a85083d89393c355064fd75a83f107d4477dd724c0356c74081dd2e22df2aac22d1c26169e9eb88a85105f83f24c8029d7f58bb96490

  • SSDEEP

    98304:MR7OR+Fx0lp21eiXdBYt3A0UR9nsqq1MlFC:+KRQav1i+T89nsqqWlFC

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2