Extracted

• • Target

    ed6abef07583d27bea1c8f10ff31f6f3.exe

  • Size

    4.3MB

  • MD5

    ed6abef07583d27bea1c8f10ff31f6f3

  • SHA1

    d3860ef0972e66409814d42b61575097eb6d40aa

  • SHA256

    85ea7702d92c135a551a65666811e85fbc3c2f062ab10be42ca80c98a4d896c6

  • SHA512

    f2b443b969a84fafbfdd09fd9e0e546bd3684f04b831df1e36f4e9ae01b02a2eb5fad83efb1e8d871a8dd7ed268d4cf8e0bee626c38a764fd4bd95490898704c

  • SSDEEP

    98304:NqLzgQQOFW5XCyu24Hi5XMP8J1+aXAlw:NkMQ8148BJ1+Plw

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2