Extracted

• • Target

    4982cf1702801f6cedce0fabdf5d5e1cf94af778b768eddad5044f923180cb89.exe

  • Size

    6.4MB

  • MD5

    d5ef7a30cb9c06cafd2654a3c8018425

  • SHA1

    b88c6e3e2abe0edd06e4565cd5b9f4f8e9a72a6c

  • SHA256

    4982cf1702801f6cedce0fabdf5d5e1cf94af778b768eddad5044f923180cb89

  • SHA512

    f409dd5c797f7117f93bd5a2ce67372b135a624bdbeaa6d457a8860e2d5460d13d01de1ffc27ea560da7f5f914204262ba1a4b77e8a26421eea5161d3d72bf0b

  • SSDEEP

    98304:4bShAumVddxYQEyKENP1xKkGSlXCgGH1w64ObLyXO:4bShApjdmstxDC1H1LbmXO

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2