cryptbot

General

Target
file.exe
Size 4.2MB
Sample241121-n7d7dssfkl
SHA256 6e71349ff091fa402e51aad05f77f65ee2eea8ec824e5b34f5284b7f11eba1f2
MD5 a02a1cb540d8658f640dba74a1ada983
SHA1 22cc7cd7bd7a3d13e441e2eff21556267fd63108
SHA512 9316ccc13bd532494ff0e34fb21312fc1f3d532c8deac805a9cfbdf0ac590d610a925edce5c24cec027c11a8e8b62499ef79abd56eeea4867a9198033d7adfd1
SSDEEP 98304:h7stmnF4VhoqbUzE0lMaq3qTmXg9aegvqYt:1vafE1lMaT95gv5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  file.exe
- Size 4.2MB
- SHA256 6e71349ff091fa402e51aad05f77f65ee2eea8ec824e5b34f5284b7f11eba1f2
- MD5 a02a1cb540d8658f640dba74a1ada983
- SHA1 22cc7cd7bd7a3d13e441e2eff21556267fd63108
- SHA512 9316ccc13bd532494ff0e34fb21312fc1f3d532c8deac805a9cfbdf0ac590d610a925edce5c24cec027c11a8e8b62499ef79abd56eeea4867a9198033d7adfd1
- SSDEEP 98304:h7stmnF4VhoqbUzE0lMaq3qTmXg9aegvqYt:1vafE1lMaT95gv5
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

cryptbot credential_access discovery evasion spyware stealer
- CryptBot
  CryptBot is a C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- Cryptbot family
  cryptbot
- Detects CryptBot payload
  CryptBot is a C++ stealer distributed widely in bundle with other software.
  spyware stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2