Extracted

• • Target

    0ab7414641e2e2f9e1cf8ea3dc9d9f3a.exe

  • Size

    4.3MB

  • MD5

    0ab7414641e2e2f9e1cf8ea3dc9d9f3a

  • SHA1

    d9ad680a3143b626c7b01a1c9582ea2d8cb660f8

  • SHA256

    527492845939bee88267250394d0342521939dd71fb7c274d0b0832bc7ff679a

  • SHA512

    51a1ed193a1be773490d6c8ad45bcab0023e22ed989d6f40b484d00cfb96632254a94b6203e72c1c14d39fe16905d465035a0c1e08b2739bbac718d09794d509

  • SSDEEP

    98304:FxhoRWdEiSqCzP394XJeW2ZLfrpwtdnrKrl2u10iEm:FxGRW2/qaPt4cW2ZbarKrwu10

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2