Extracted

• • Target

    7dc314359cdb76163923b61fc91175c7a09577e37443ca9711ba9c6b33863391.exe

  • Size

    4.2MB

  • MD5

    8a549f15d1418fb4207aadb4ba813a36

  • SHA1

    9019f532acc00096055788d1212842e8bec35627

  • SHA256

    7dc314359cdb76163923b61fc91175c7a09577e37443ca9711ba9c6b33863391

  • SHA512

    1aadc1a1eb8715f02108a6df2b28852c58399335a4760afaa9d7637612b117b118d1f7dcbb9bdbb63a067872b7ee37669379575b51b207678cf55c2d45acfbab

  • SSDEEP

    98304:tom43DbewIxtiiOomSa347fCM65XFKZcdow9vbFgCAuj1:m7zb4CmaOfI/xTFGy

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2