Extracted

• • Target

    b56898518eaaa502f048f88e88ba890eddffa54fd0fe2a32da7a2ae4c6a54214

  • Size

    4.2MB

  • MD5

    7d428fcf377f6d515c378d45dbd193df

  • SHA1

    c610093028374c297a332f9b0885e25a4574f068

  • SHA256

    b56898518eaaa502f048f88e88ba890eddffa54fd0fe2a32da7a2ae4c6a54214

  • SHA512

    45b1c0c44f0cee2bdde60885d230b5afd11da1111c3d2e32d2cd45f19a6e60611f5f5f2d7fca24e54fc4764687b0b32b6750e727907ceb5376d56483fd395046

  • SSDEEP

    98304:6AaKzQzprHmX5cZNjOLezCtSAO5vlRp7Zy8t2usZBMQiVRF8Iufd:6AFUzpDmX5ExZAO5vJ7ZymiB7Sk

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2