Extracted

• • Target

    a5c463db805e356cb6e73e5676b397eab265e061c6797e27b626b8b4aee892a3.exe

  • Size

    740KB

  • MD5

    e458dc2ba9e161ea08ff8bebea2a469e

  • SHA1

    33c3d82ad1a6ae6025f3c6d7230b7182da4b0765

  • SHA256

    a5c463db805e356cb6e73e5676b397eab265e061c6797e27b626b8b4aee892a3

  • SHA512

    f798ec39f39ecff88ed5092751e4500f4f7542e74d4b4c118b1dd85c390186d00b543aa9f26d6baf1317993bd7ee360177eb32b5c698d0356be3bbf1cb7d9eb1

  • SSDEEP

    12288:0LbDQ1c1lf8x4vIN92yhfgO8B8dpSfWGklyqJ64Ocg8PZCpdnvkv5:0LXQ1c19e44jgN8dpWWGvw6zcdhIdnvo

  Score

  10^/10

  cryptbotdiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • CryptBot payload

  • Cryptbot family

    cryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2