Extracted

• • Target

    file.exe

  • Size

    4.3MB

  • MD5

    e9d01cec59d8e2aec09a3eb40646e9bf

  • SHA1

    cf50c8d1f9fd14327684af745c2ded0c181c82a8

  • SHA256

    19d0f6b9a8d1ff3ec8a861ca37da7257b1c7db831fb89b812b763928055857fe

  • SHA512

    49d7a89f82c87106f21b53efa9cbbc6365d67403e5a511222d734ab74a5afcd5c5b582e6887b0c1a164532698f6b7034d85839aacb5093976505e54283cab3b4

  • SSDEEP

    98304:uJOpvZrjOFbmJ1oZmSNBxdTTrW+nsrOCRR4AMWAr:1ph/OFbm5SNdTO+nszbW

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2