Extracted

• • Target

    42e46ac1d7643cd42ca0968bfbb9431a.exe

  • Size

    4.2MB

  • MD5

    42e46ac1d7643cd42ca0968bfbb9431a

  • SHA1

    b2c838088e8c80939b27beda663e2a0e1900d8fe

  • SHA256

    67b9d9255af3bad550cfa7c8b1a382c2d31c039a2b012e2460f85d9556716477

  • SHA512

    f6ddedeabec8e4459330abde1838b93da7f387eaf518b4caa731d90d54e4ed355a699dc4feeeeff79d3855e57778ec8e2eb7f75b851e258072eb41a1ad4ccc10

  • SSDEEP

    98304:oKlXuTCyDQgJ5HzMKO1M0yODzk1mp1xJlQEY6UaAM1h:flXuTCEfJ5ThO1MQzcmp1rlPAM1

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2