Extracted

• • Target

    9b4321c5053081493b0aa919e8254f677fd19faed543de23b080967d1ad6ab27.exe

  • Size

    6.3MB

  • MD5

    6e860af01695658d323ab44a31ba7c6b

  • SHA1

    1979b1ca9019f3f06caf3c5cb693f0b231914013

  • SHA256

    9b4321c5053081493b0aa919e8254f677fd19faed543de23b080967d1ad6ab27

  • SHA512

    8be53bddb6be33eeab9a240b6b3c5224e48390dceb0778f2867f91eb2dd39415ae277a16868d491e50a8eb3d9786bfea8abb04a3de266ab5dbc022e6ebcea2ef

  • SSDEEP

    49152:ZwLJPgbiuVmmAHi0AwnvAtix2jm5q+98j56xW2jKrWDahVg6eWt6v9N60WICDZof:inxjj2gPsO9vwOqAcwdixZIW6

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2