Extracted

• • Target

    file.exe

  • Size

    4.3MB

  • MD5

    cdee2aadc9a1d83264d60129891ca8c7

  • SHA1

    2ffc082892de4d483f53791ef35d5bc45dc96dcd

  • SHA256

    74211c92533f725825f0d2c05815b44d8b89c370a202007b46d3b09c5ef19ec9

  • SHA512

    a6280b9759fb1764ea8b755c9f2beb0cad450a273e2d7bfc38b374a4ca7da3bc7ccb84b74e2fdf39d23dd4f5713a84364386f8e8877b44b9de625543812cf35f

  • SSDEEP

    98304:b16yNMldzSUcQ1zMr+zfXEbwgAAghK6YPXN3Q/K6zUp+3Jx0:b16yGPlzMr4U8/kX9Qi6zY

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2