Extracted

• • Target
    file.exe
  • Size 4.3MB
  • SHA256 2988e47d969e3ff7213d48189492aa8e881c8a20e608fa43f83cdab41c4aec2e
  • MD5 99fb9bbde27a9a71abd4a47494f8e8ac
  • SHA1 438157f516f8be5122299792a19f7925886288b7
  • SHA512 499fc611acaab7f4b236cd5ae3921eb69d901e444d3f541bfe6554de37d394656e0e7a1df62597eef5f5ad47e138130d8c35e9e4cfa7b1a68a4c1e1d24d66d09
  • SSDEEP 98304:kFR3z8YVXuvHVYvaXsjmThkblBsMxmIE2TTrkw0LoEIeax4Ydce4Hh7P:4hzBVq1YvM2mVhMtfalIR4kSHl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2