Extracted

• • Target

    2802d71a1e4a703ffbef8ce02a5f844731ef6644a4d5894acc593cbdb90a40a4.exe

  • Size

    6.4MB

  • MD5

    78f9470c1fc9e230702bfc8e1668a8c8

  • SHA1

    b0a3cc1c084d11c8f5004a30be115ecb9cdccc28

  • SHA256

    2802d71a1e4a703ffbef8ce02a5f844731ef6644a4d5894acc593cbdb90a40a4

  • SHA512

    eccf5eeb26e80a76bbcfcb9d4deced821f5ecb3ee03c39754936e84062bb9fcea97d2019a847e48031a970d49cdff1a9c54890425624acd50c3a729a51984092

  • SSDEEP

    49152:Mw7BZNWgS9U6qtqDYXnE6dkgNX1KQStaXIAZyC9uCETFHx+RERqbDmr6gKQHuRDY:MIZIgs006eghIQSta0CcRqfobPeG

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2