General
-
Target
cc3d2a27b65460eaab6b10b54deb020607d2224b7f59bcb7e1c39dc6a0448014.exe
-
Size
4.3MB
-
Sample
241219-ekq31awrgs
-
MD5
0727f6695b901a967a15595da4d44ba9
-
SHA1
78d6de0388e64b5a99d84ad66a34bd6910820c05
-
SHA256
cc3d2a27b65460eaab6b10b54deb020607d2224b7f59bcb7e1c39dc6a0448014
-
SHA512
3ef1e7c3579650a3f8e4572e72ccfa2a297af44011e42815f12404a0102eb15b1e9c0f61920a340e7ab9af5297c4ea222066ab556b15a02aee2a66ac12d8bfd1
-
SSDEEP
98304:poFB3fFGSsbtiWXpD7xjVw+UEln+YxnSwxMETRdavZq0hzpK5zjcs:pURsbtVhxe+UYn+Gk8ROME
Static task
static1
Behavioral task
behavioral1
Sample
cc3d2a27b65460eaab6b10b54deb020607d2224b7f59bcb7e1c39dc6a0448014.exe
Resource
win7-20241010-en
Malware Config
Extracted
cryptbot
Targets
-
-
Target
cc3d2a27b65460eaab6b10b54deb020607d2224b7f59bcb7e1c39dc6a0448014.exe
-
Size
4.3MB
-
MD5
0727f6695b901a967a15595da4d44ba9
-
SHA1
78d6de0388e64b5a99d84ad66a34bd6910820c05
-
SHA256
cc3d2a27b65460eaab6b10b54deb020607d2224b7f59bcb7e1c39dc6a0448014
-
SHA512
3ef1e7c3579650a3f8e4572e72ccfa2a297af44011e42815f12404a0102eb15b1e9c0f61920a340e7ab9af5297c4ea222066ab556b15a02aee2a66ac12d8bfd1
-
SSDEEP
98304:poFB3fFGSsbtiWXpD7xjVw+UEln+YxnSwxMETRdavZq0hzpK5zjcs:pURsbtVhxe+UYn+Gk8ROME
-
Cryptbot family
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-