Overview

overview

10

Static

static

3

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    4.2MB

  • Sample

    241119-qdr79sxbqr

  • MD5

    46a5f6eb5c061a6c8999c6a3c9cd94b5

  • SHA1

    601bec022812bb831ba6416bb55af390b6871cfc

  • SHA256

    7696b18fe38e3ab65ae8399367be364777bf685af9f63c22936e4f9c68b42488

  • SHA512

    d337bf28b870c1160d102a7a599fac2dcd3a5643e9c5cc71a69600ed81b5b7ef25a03bc7db7a5f8ba2bfeeb0c60ba953fedb44224ddae4c60324a835746d558b

  • SSDEEP

    98304:JMXYcDhEdxO0aC0FWMU5sPPLZUX3RXN/M23/0Bc:JMXZExn4FWMScmnRXN/h34

Score
10/10
cryptbotdiscoveryevasionspywarestealer

Malware Config

Targets

    • Target

      file.exe

    • Size

      4.2MB

    • MD5

      46a5f6eb5c061a6c8999c6a3c9cd94b5

    • SHA1

      601bec022812bb831ba6416bb55af390b6871cfc

    • SHA256

      7696b18fe38e3ab65ae8399367be364777bf685af9f63c22936e4f9c68b42488

    • SHA512

      d337bf28b870c1160d102a7a599fac2dcd3a5643e9c5cc71a69600ed81b5b7ef25a03bc7db7a5f8ba2bfeeb0c60ba953fedb44224ddae4c60324a835746d558b

    • SSDEEP

      98304:JMXYcDhEdxO0aC0FWMU5sPPLZUX3RXN/M23/0Bc:JMXZExn4FWMScmnRXN/h34

    Score
    10/10
    cryptbotdiscoveryevasionspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • Cryptbot family

      cryptbot

    • Detects CryptBot payload

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealer

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks