Extracted

• • Target

    490fc3ac1830a381350813ad614c258eb761886aad612879a592461edffd719b_Sigmanly

  • Size

    4.2MB

  • MD5

    8841698b335573b0abe7875b85b653d6

  • SHA1

    e74926dcb5b7e996d4f4961a763d2c4d8e8e24d0

  • SHA256

    490fc3ac1830a381350813ad614c258eb761886aad612879a592461edffd719b

  • SHA512

    2f8941aaf2724687e70f4c742ac2f3a2009df18776d8e182a3042eb33422463df109e1e666d8f8a66cd7f6312e86aa9dd4a127c5559e04cbd57a6da51077e037

  • SSDEEP

    98304:4Ha58BJIGJlaZO5+OFpubzo4p3BRTPb5Nk/B8R:47wbz97PDkJ

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2