Extracted

• • Target

    2ed56e48acd3d32e3d047b42b18103aa.exe

  • Size

    4.3MB

  • MD5

    2ed56e48acd3d32e3d047b42b18103aa

  • SHA1

    7f3a1c7ac09fb36680a29b5d964afabf5566dd02

  • SHA256

    f7c192eeb6246cd1b3e3772b80057f6f74e1be940d3a7ded223b165589b9f154

  • SHA512

    53d40e9a17c0ee95d9c2daa5d2df1e831dda9c291402edf90964e558c002abe6801630971797149a571e50dd25043f8b5236d653f4ad83d12a78c82453ecfed2

  • SSDEEP

    98304:LcTnO9WxVe3Y8ukR0YjkKj1CEhAdsp6/AovV+KGAuYGTD6F8uvu:LwaWx439tok1CIhkt1wq8

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2