Extracted

• • Target

    fa2b9ef3eedea37bee3f07f9a580ca57.exe

  • Size

    4.2MB

  • MD5

    fa2b9ef3eedea37bee3f07f9a580ca57

  • SHA1

    886267a5d0287a9e8385aa7337f7c0dfb6e0c3b2

  • SHA256

    bb2af2fb0383047e427ce40b100535426c1037778a3e3c713158d02d6ab6c8a2

  • SHA512

    a5ffb97936a0c9b4451436b9b8d5e433a108ad5c9c70c9bce55e8597e7b76e9d8d0786663f9e535bb313a51a1ed75a482c08dba6ec64eafe46029905ad406f64

  • SSDEEP

    98304:zv6kd7asndqddLBjfGQxzLbSin3lUwwLWzFfZvR:rrVdqTBDGgbcRLWzFH

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2