cryptbot

General

Target

3ad8c88d84d5321bbb6dd6f8fb5b2cff5b8a57dad4c93077270187b2e9ada8c2.exe
Size

4.2MB
Sample

241119-exdnfa1ckm
MD5

e1aad757dfacc743077c8e5f4502f65c
SHA1

df995b733af7477c630e7e8026e676b83f0ca1a5
SHA256

3ad8c88d84d5321bbb6dd6f8fb5b2cff5b8a57dad4c93077270187b2e9ada8c2
SHA512

63066b1442208a12e102655a56165b6b66137521a2887245e7d1df4adf77b57a2c744c506d71d02fa476a7d807f9f653d3acafdf902ec878a85d7fabcdf78f1d
SSDEEP

98304:RCXPFJGUfvAltWbSQeATJI2Q6bEg7aOXkkR3iOJ3KFa+X+f1+d12TmFGHFAT:QPiUnArWb5eATG4Ag7lwsKFajN+j2TTa

Score

10^/10

Malware Config

Targets

- Target
  
  3ad8c88d84d5321bbb6dd6f8fb5b2cff5b8a57dad4c93077270187b2e9ada8c2.exe
- Size
  
  4.2MB
- MD5
  
  e1aad757dfacc743077c8e5f4502f65c
- SHA1
  
  df995b733af7477c630e7e8026e676b83f0ca1a5
- SHA256
  
  3ad8c88d84d5321bbb6dd6f8fb5b2cff5b8a57dad4c93077270187b2e9ada8c2
- SHA512
  
  63066b1442208a12e102655a56165b6b66137521a2887245e7d1df4adf77b57a2c744c506d71d02fa476a7d807f9f653d3acafdf902ec878a85d7fabcdf78f1d
- SSDEEP
  
  98304:RCXPFJGUfvAltWbSQeATJI2Q6bEg7aOXkkR3iOJ3KFa+X+f1+d12TmFGHFAT:QPiUnArWb5eATG4Ag7lwsKFajN+j2TTa
Score

10^/10

cryptbot credential_access discovery evasion spyware stealer
- CryptBot
  CryptBot is a C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- Cryptbot family
  cryptbot
- Detects CryptBot payload
  CryptBot is a C++ stealer distributed widely in bundle with other software.
  spyware stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2