Extracted

• • Target

    13f456703cb69ceaef4790a962bcdb558f297ba665b8fe3d217014c2cb3d8d80.exe

  • Size

    4.3MB

  • MD5

    5312396558c20ea6b5a35f455f461559

  • SHA1

    e980188e03dcdff45817d98b216c35c52a7d87a1

  • SHA256

    13f456703cb69ceaef4790a962bcdb558f297ba665b8fe3d217014c2cb3d8d80

  • SHA512

    135d77dc30d1b20d4fc5dd38803c5e49513f6ddf4dd3a85c5b8cbe8dfd5ce988f132ee2bb79a9b4a01ec63cff8aa5e3bb25947197692963c03aff687ad8e6a05

  • SSDEEP

    98304:zT+NktHmTJhfbyx3Wsj77HnVXjEi/ce+AZwHhElqOWBa6i6vt1O:z6udmTJpbyxms/D1QiFjwBElqOWRT

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2