Extracted

• • Target

    ff26742815c194fb24443f99d7c7a06c584a9e7f68c774fb1c0a078b8785ac43

  • Size

    6.3MB

  • MD5

    fae6741839e3a1dd529063fe2bdd6ead

  • SHA1

    ed30aa0dc87299d8ea952af887e5c5b9d095b9de

  • SHA256

    ff26742815c194fb24443f99d7c7a06c584a9e7f68c774fb1c0a078b8785ac43

  • SHA512

    c9bbb80c0bc0c3797839af5523ca4f407d17c7b7883572b9142721775789faf3f22193552f7c96df87010fcd54b68dba134fefe12c01f91efe4beed49c80bf34

  • SSDEEP

    98304:/90jx80IQXO8aBULQG3Rd+jbkRMsHCQCnn6n:/90jx8OFAnNoRMsiz6n

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2