Extracted

• • Target

    9cec95210688605c2d91081c1d9fbd75ca55b8f028f658d402aa1d288293983d.exe

  • Size

    4.2MB

  • MD5

    2453b4be7a014499138f1029edcbf013

  • SHA1

    13087911bc9b06066f076d842b1ce8ac4688ac0c

  • SHA256

    9cec95210688605c2d91081c1d9fbd75ca55b8f028f658d402aa1d288293983d

  • SHA512

    838ef33c48f833759ce6f552728db4bdb567864612005535e0ebe81f2e71b85f74891b0c340ab5b1980bd0b63d1eac916784687cb3af5a4fffd88c3789094224

  • SSDEEP

    98304:UN+uD7A2mt3r4FKkfeap4VPS597W17xAHrC1yAswHx:UBA2mBbk14BKHC6

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2