General
- Target file.exe
- Size 4.2MB
- Sample241120-zkvfmsseqc
- SHA256 27d7a74aa353a79ad0e8de90f591165248c92a914d7a7cf447267599f9181b49
Malware Config
Targets
-
- Target file.exe
- Size 4.2MB
- SHA256 27d7a74aa353a79ad0e8de90f591165248c92a914d7a7cf447267599f9181b49
Score10/10CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
Cryptbot family
Detects CryptBot payload
CryptBot is a C++ stealer distributed widely in bundle with other software.
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v15
Persistence
Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1