Extracted

• • Target

    a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610.exe

  • Size

    6.4MB

  • MD5

    af196dcc95170ab54860051830a7d587

  • SHA1

    9fecb3cfb22a2717c5f0424aa7c197d0ab80c365

  • SHA256

    a8a451b18143b192de1f6da327400e4fe0b629386d0c9dbf0d77e002e8ca6610

  • SHA512

    e985bdc5722c415e6d80abb4acdefb55693e79566062f83c9137b8e3db2813b95d33c6da12259667182e94d5198095703e8b57083872c997f8ea932cd3fc40ab

  • SSDEEP

    98304:Aevoj/6GK58KRA6t5oHkokMCtQYGDOdA8RcWwlLQmjnAoX:AwojiGK58+A6tyHkokjlb+LnjAoX

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2