cryptbot

General

Target
b6d4e8e108defd1bdbfccb79dd7ab963d3d18aed0482dc03dc21ef42424d2c00.exe
Size 4.1MB
Sample241122-j8ahdatkdk
SHA256 b6d4e8e108defd1bdbfccb79dd7ab963d3d18aed0482dc03dc21ef42424d2c00
MD5 c58f5d34befa71283f1bde52b96b3c2d
SHA1 280377ad5c23425b842a63d10d739b32a7bae57e
SHA512 3f245d3e253aac48bc6aa77ffdcadbedbe420353383ecab0d7c87c07d800ddd0fe1ccaf7aea9ab5bc8399053e5ad10f4ba6bdcc3a51d0acb1bef120813784153
SSDEEP 98304:B9Njdz3gVVo8KPTFqhcDthVheU4CJl1zR1zzRqJ2trCyTA:HLrl71nfeU4CrZzVqgt1TA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  b6d4e8e108defd1bdbfccb79dd7ab963d3d18aed0482dc03dc21ef42424d2c00.exe
- Size 4.1MB
- SHA256 b6d4e8e108defd1bdbfccb79dd7ab963d3d18aed0482dc03dc21ef42424d2c00
- MD5 c58f5d34befa71283f1bde52b96b3c2d
- SHA1 280377ad5c23425b842a63d10d739b32a7bae57e
- SHA512 3f245d3e253aac48bc6aa77ffdcadbedbe420353383ecab0d7c87c07d800ddd0fe1ccaf7aea9ab5bc8399053e5ad10f4ba6bdcc3a51d0acb1bef120813784153
- SSDEEP 98304:B9Njdz3gVVo8KPTFqhcDthVheU4CJl1zR1zzRqJ2trCyTA:HLrl71nfeU4CrZzVqgt1TA
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

cryptbot credential_access discovery evasion spyware stealer
- CryptBot
  CryptBot is a C++ stealer distributed widely in bundle with other software.
  spyware stealer cryptbot
- Cryptbot family
  cryptbot
- Detects CryptBot payload
  CryptBot is a C++ stealer distributed widely in bundle with other software.
  spyware stealer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2