Extracted

• • Target

    JaffaCakes118_56f3dcaa23c6f1f9fb9178fcf382168773b832236dc2955e24964e0acc6f0884

  • Size

    727.6MB

  • MD5

    e8eafc4826f22001b09f5cee3e46e54e

  • SHA1

    e66b4001dc5fc5183a78253a649619b815a9c873

  • SHA256

    56f3dcaa23c6f1f9fb9178fcf382168773b832236dc2955e24964e0acc6f0884

  • SHA512

    e08cf4e23eb3953ceb473f1175602d6ac3d7ab4677f44d971d0bedc7ca0c837acff523f9b78fe28b50d60ba3a9f39410fe4ac348410ddbd3b30d3d826ce02c3d

  • SSDEEP

    196608:mTdgDIK/MAVDXme7TshVez4GwrwTT19lGO5A/+:fP/JcWeruJ3

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2