Extracted

• • Target

    file.exe

  • Size

    6.3MB

  • MD5

    2426fa19f0c2cc5de92d6ef43337c2d1

  • SHA1

    97b742a006365ad06a8d0933da8d72c51cca8e63

  • SHA256

    4d10776348522e720fd36f175f9f735039e4aa3ae9543886320cd75e45e77754

  • SHA512

    e6dfea55d923c4fa9a6e2e1d9dfa63ec1a5a4b34ce652dbed7b1442f92e628a18d7734128c735757665e07ceb4ca1fff891bea816925177462181242c6075690

  • SSDEEP

    49152:HEpLcqGtEt9N3TZJP4it6eBVwK1tN4VMFeh9wO8pavgzG25VJGS+0DA7k67laoxL:HEpNLsLwK8JxNDAAdIH1wrtF/5kL9Et+

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2