Extracted

• • Target

    798d79739b14a81a4a885b9da999d558d9bbd746d11c4774c6286c468b9136ec

  • Size

    1.8MB

  • MD5

    c54dd38ad93debf5e88733334754ad9d

  • SHA1

    4c0831407939f3c86b65ca3995262acdbe15f24b

  • SHA256

    798d79739b14a81a4a885b9da999d558d9bbd746d11c4774c6286c468b9136ec

  • SHA512

    fdf13db5737d57d7fcd7fb6fb1db46bee924cb16d701304c4a7169a8c6be7d91e3936a95914076bfa5374338853005d999877a754f16917cf295981695e88089

  • SSDEEP

    24576:wBkVdlYA/HualkUuCoT9p1WFO54xMfYavo7NEYcqzNwhnK1e:Qsv/uaOwef1Ww4xAvdYcqe0w

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2