Extracted

• • Target

    183c36ee3ad752f285926be4964605bc382369baea99bb528a14f34f24fd1a0f

  • Size

    4.2MB

  • MD5

    ea139ce157017edaa2f1e02a542511f1

  • SHA1

    232813abc1d12b97993d003856576888aa726fbd

  • SHA256

    183c36ee3ad752f285926be4964605bc382369baea99bb528a14f34f24fd1a0f

  • SHA512

    6dbd95b8408ba2bb6912c4317b9604ccb887891ba14506588df7756a6b1ca6337c22c3edbcadaec0b4fdc50e5c55c682d6f6182535082e8cc608899602bea8bf

  • SSDEEP

    98304:EK7gDjHWlGX0IteolSDXduV/CybcRj80N/sXDx30D+1cNJt/b6Bl9k3:EK7gHlEAtl8Xchbc91m3W1/aLm

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    $PLUGINSDIR/System.dll

  • Size

    11KB

  • MD5

    bf712f32249029466fa86756f5546950

  • SHA1

    75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

  • SHA256

    7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

  • SHA512

    13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

  • SSDEEP

    192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    $PLUGINSDIR/UAC.dll

  • Size

    14KB

  • MD5

    adb29e6b186daa765dc750128649b63d

  • SHA1

    160cbdc4cb0ac2c142d361df138c537aa7e708c9

  • SHA256

    2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

  • SHA512

    b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

  • SSDEEP

    192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs

  Score

  3^/10

  discovery
  behavioral5behavioral6

• • Target

    $PLUGINSDIR/UserInfo.dll

  • Size

    4KB

  • MD5

    c7ce0e47c83525983fd2c4c9566b4aad

  • SHA1

    38b7ad7bb32ffae35540fce373b8a671878dc54e

  • SHA256

    6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae

  • SHA512

    ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

  Score

  3^/10

  discovery
  behavioral7behavioral8

• • Target

    $PLUGINSDIR/nsDialogs.dll

  • Size

    9KB

  • MD5

    4ccc4a742d4423f2f0ed744fd9c81f63

  • SHA1

    704f00a1acc327fd879cf75fc90d0b8f927c36bc

  • SHA256

    416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

  • SHA512

    790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

  • SSDEEP

    192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi

  Score

  3^/10

  discovery
  behavioral10behavioral9

• • Target

    Set.exe

  • Size

    2.0MB

  • MD5

    57a124f28215ba2dfbe7b8d264b0741b

  • SHA1

    285f1f0ede5561caba18c6d5f6b95efd7f652293

  • SHA256

    683f4c758e2b8cfc95d9df625c17ece1d9c3fe4ab4fb33e8924d0bc8618eb6b7

  • SHA512

    9f45535df4e00acb612f3d15be1d4082e1027d3cdb39a9547a2d8e8c86d2e8950a0285512eacbbd6ce73608ab3f28edbf0c90059a83497d3f392e457435a3557

  • SSDEEP

    49152:ydhg+xjQ/7kYfR/JomNOpiTB7Pakt090tb64I4MO:ggMjK7Df1Jo4eiTtp0I6J4MO

  Score

  9^/10

  discoveryevasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral11behavioral12

• • Target

    Setup.exe

  • Size

    2.2MB

  • MD5

    f15df54a6784030231c5ac44bd99c487

  • SHA1

    ab3e392fc7ac8503ac6013fbe1981f21274ce0c4

  • SHA256

    0eb59683e2dfd231d3a0a4bdf17d9a2c6871e29f99dcef2bef80dcd3006edd86

  • SHA512

    1be6149eb8a0c9a94ae1d92a97256b388f982a9c1021d3c3ec049b6354a5d3c253af2dbb9517ef3c9f1b9600ed18a2f59a6d6b3ab5a94b110dd7d719d48c4321

  • SSDEEP

    49152:wCHFzR0SjCrsYebwHAwKQOCG/nWCGTl7CcL9xjYNaSgu+GtnX:JFzRK4Y/HAwKQ51FZ7HLfjJSgu+GtnX

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral13behavioral14

• • Target

    enigma_ide64.dll

  • Size

    41KB

  • MD5

    39db21ffd436484891026a5e99710b26

  • SHA1

    2b736f826bd2d7ce215f8048b5f73d0b330b12b0

  • SHA256

    5141f9f501eb6c8f402db79f99b5a21998bd7ce1e28eb077c565e34b2a2be891

  • SHA512

    47debf6588f27454414a0a2b4eae6ba2ade7ecd00802ad1bf8f6c52a3b1a64a025149a953743587d46dc5e392e12350329465b31c206a40ace64c77a33d4705e

  • SSDEEP

    768:QxyTrKwS3DjRWxNysLx/rlqKtkKZEZvHYkc/Fv:HTrrSaRlxDm3c/

  Score

  1^/10
  behavioral15behavioral16