cryptbot

General

Target
1b352e12943c9b113607e78cdf7f1e88.bin
Size 4.1MB
Sample241121-bda7esxakd
SHA256 c3c641417eac4b5b420ebd70ed5be42a692bc7bce7e06e83ac7451021405cb41
MD5 b6063b6bc1f52c8e19f642202d5d04da
SHA1 2c850f24afda502dad9a03c4283d3846bea05084
SHA512 4711de42584d16caa9877c285ec66e5f8bc5bd64a9d9270a35227acc2dc049b2df3125ae4af1e94571deeb3c68538db560fbc228a612005d674e4b6178ad3823
SSDEEP 98304:ocjGk1sQbUDKyRNzg/HlC+bhkGCGUJtyStNdWS:hGisga+PqGEyStZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  e14efbaf799412719eebbbad024b9fe3fae5aa665e7b885cbc05466ee04f4c07.exe
- Size 4.2MB
- SHA256 e14efbaf799412719eebbbad024b9fe3fae5aa665e7b885cbc05466ee04f4c07
- MD5 1b352e12943c9b113607e78cdf7f1e88
- SHA1 2978dd75e9ad8aa608d41f430e2391ac94661cfe
- SHA512 5265e205a86ac37348a7b09fef6b92355da07e9aa01ebd973f482eac0546b82350ae86cba6f629dec1b454b26c72df6256d1cf69fb1b0ab01930f734b575aa98
- SSDEEP 98304:I+GM6QbqnEFJoA3ozvuYx42ZaSshADK5+vvygxDzYpmte1:vGMTbqnEDoTCYx42YSshADCsDz0mt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

cryptbot credential_access discovery evasion spyware stealer
- CryptBot
  CryptBot is a C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- Cryptbot family
  cryptbot
- Detects CryptBot payload
  CryptBot is a C++ stealer distributed widely in bundle with other software.
  spyware stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2