Overview

overview

10

Static

static

3

setup_x86_...1).exe

windows7-x64

10

setup_x86_...1).exe

windows10-2004-x64

10

setup_x86_...0).exe

windows7-x64

10

setup_x86_...0).exe

windows10-2004-x64

10

setup_x86_...1).exe

windows7-x64

10

setup_x86_...1).exe

windows10-2004-x64

10

setup_x86_...2).exe

windows7-x64

10

setup_x86_...2).exe

windows10-2004-x64

10

setup_x86_...3).exe

windows7-x64

10

setup_x86_...3).exe

windows10-2004-x64

10

setup_x86_...4).exe

windows7-x64

10

setup_x86_...4).exe

windows10-2004-x64

10

setup_x86_...5).exe

windows7-x64

10

setup_x86_...5).exe

windows10-2004-x64

10

setup_x86_...6).exe

windows7-x64

10

setup_x86_...6).exe

windows10-2004-x64

10

setup_x86_...7).exe

windows7-x64

10

setup_x86_...7).exe

windows10-2004-x64

10

setup_x86_...8).exe

windows7-x64

10

setup_x86_...8).exe

windows10-2004-x64

10

setup_x86_...9).exe

windows7-x64

10

setup_x86_...9).exe

windows10-2004-x64

10

setup_x86_...2).exe

windows7-x64

10

setup_x86_...2).exe

windows10-2004-x64

10

setup_x86_...0).exe

windows7-x64

10

setup_x86_...0).exe

windows10-2004-x64

10

setup_x86_...1).exe

windows7-x64

10

setup_x86_...1).exe

windows10-2004-x64

10

setup_x86_...2).exe

windows7-x64

10

setup_x86_...2).exe

windows10-2004-x64

10

setup_x86_...3).exe

windows7-x64

10

setup_x86_...3).exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4e0cbe9c0d9d6734b69aa74e0494f5f4d24094dafa15985e0bd1d81c9a29b55e

  • Size

    44.6MB

  • Sample

    241224-b4actaxrht

  • MD5

    ac2767808610a106345f868c76ea1e95

  • SHA1

    4f33d7b3c16c9356dfc4901f8194daa1ae3cd0dc

  • SHA256

    4e0cbe9c0d9d6734b69aa74e0494f5f4d24094dafa15985e0bd1d81c9a29b55e

  • SHA512

    1fb6d61e7e021c4c18fe71ea9994ff1f0f5a4a1e4239840ddc53c351f440996d39141de2e746858cef555315f621e42bc5a3d1f55cfabf47715767b74d46101d

  • SSDEEP

    393216:C4qCwWy4qCwWM4qCwWB4qCwWl4qCwWc4qCwW44qCwWa4qCwWS4qCwWH4qCwWf4qX:8j9eKLX9FIIXjuibvRxEciL5hf2J

Score
10/10
cryptbotdiscoveryspywarestealer

Malware Config

Targets

    • Target

      setup_x86_x64_install (1).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

    • Target

      setup_x86_x64_install (10).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral3behavioral4

    • Target

      setup_x86_x64_install (11).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral5behavioral6

    • Target

      setup_x86_x64_install (12).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral7behavioral8

    • Target

      setup_x86_x64_install (13).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral10behavioral9

    • Target

      setup_x86_x64_install (14).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral11behavioral12

    • Target

      setup_x86_x64_install (15).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral13behavioral14

    • Target

      setup_x86_x64_install (16).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral15behavioral16

    • Target

      setup_x86_x64_install (17).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral17behavioral18

    • Target

      setup_x86_x64_install (18).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral19behavioral20

    • Target

      setup_x86_x64_install (19).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral21behavioral22

    • Target

      setup_x86_x64_install (2).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral23behavioral24

    • Target

      setup_x86_x64_install (20).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral25behavioral26

    • Target

      setup_x86_x64_install (21).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral27behavioral28

    • Target

      setup_x86_x64_install (22).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral29behavioral30

    • Target

      setup_x86_x64_install (23).exe

    • Size

      1.8MB

    • MD5

      961ed865e49001eab634e7f1d49d4865

    • SHA1

      ac28f77d1b75703518ebf6df8cdafa77da9a08aa

    • SHA256

      00bea63783ba58ffe8a63b70aa5c4c019491bed0a92ed17148836409ab7e5cc1

    • SHA512

      8d13430e0fd68959239475082822a11e681f3923471ba0cbb7bf906da86fc940b19a1e81e2a1494deee5b6fe08da8bc6ab715dcd08edb5a4f9755e39a4bbdd4a

    • SSDEEP

      24576:L3hOb1cU1l+aHBs8D3tCXG5IfsvYAPzTvW/SWlWIPqz0beYU2Z5gsUtR/VUTUb3/:LxOpmX70uDMQDU/FVUTURHinXuaa

    Score
    10/10
    cryptbotdiscoveryspywarestealer

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

      spywarestealercryptbot

    • CryptBot payload

    • Cryptbot family

      cryptbot

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral2

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral3

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral4

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral5

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral6

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral7

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral8

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral9

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral10

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral11

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral12

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral13

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral14

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral15

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral16

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral17

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral18

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral19

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral20

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral21

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral22

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral23

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral24

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral25

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral26

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral27

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral28

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral29

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral30

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral31

cryptbotdiscoveryspywarestealer
Score
10/10

behavioral32

cryptbotdiscoveryspywarestealer
Score
10/10