cryptbot

General

Target

file.exe
Size

4.2MB
Sample

241119-drxcxszjfz
MD5

0bd6fb5f0ba4460ad6f658894adb9874
SHA1

5eec17725b6bf038c21b15b9c5e3c81f09b25ead
SHA256

19de4e31f35bc0e2876217eb616667a91ec02f94207740e66a556e3eae2e4ae3
SHA512

c014c8083f66efe22b4cf5e868709bc1b8b063d438c53c0843fbcfe67bcccdd5bc26ede47276ad41eb65dbcc0a02550032da4ed73a5145896674dd885c83b176
SSDEEP

98304:q4XApBHouES1YKWjQyRxbpWDOMAtxG2w14K0JmeprbE:xeHoZ1RRP8axG2wGnxu

Score

10^/10

Malware Config

Targets

- Target
  
  file.exe
- Size
  
  4.2MB
- MD5
  
  0bd6fb5f0ba4460ad6f658894adb9874
- SHA1
  
  5eec17725b6bf038c21b15b9c5e3c81f09b25ead
- SHA256
  
  19de4e31f35bc0e2876217eb616667a91ec02f94207740e66a556e3eae2e4ae3
- SHA512
  
  c014c8083f66efe22b4cf5e868709bc1b8b063d438c53c0843fbcfe67bcccdd5bc26ede47276ad41eb65dbcc0a02550032da4ed73a5145896674dd885c83b176
- SSDEEP
  
  98304:q4XApBHouES1YKWjQyRxbpWDOMAtxG2w14K0JmeprbE:xeHoZ1RRP8axG2wGnxu
Score

10^/10

cryptbot credential_access discovery evasion spyware stealer
- CryptBot
  CryptBot is a C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- Cryptbot family
  cryptbot
- Detects CryptBot payload
  CryptBot is a C++ stealer distributed widely in bundle with other software.
  spyware stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2