General
-
Target
504d077daa7afdeab4134d2c14ad5c0565a92447ec41992503262775b963ec8a.exe
-
Size
4.3MB
-
Sample
241224-eahc4s1nfj
-
MD5
eadb20865c939c361c835f8367e83ad8
-
SHA1
4a1ca5baf301951639c536b9b495efa49cd4b4b1
-
SHA256
504d077daa7afdeab4134d2c14ad5c0565a92447ec41992503262775b963ec8a
-
SHA512
070b123d5d1ff86c80e18d167372149cf631d3eb411cd82ce75319d0d21ad870727d284daf7e74bdd34898897aef2ff0e4ac055f8e40a4b0133faa158c3ec783
-
SSDEEP
98304:6DGBvlaixmb3UPwXl/Z4QjOMTbweJr7yd3:M8lai/QVZnK0
Static task
static1
Behavioral task
behavioral1
Sample
504d077daa7afdeab4134d2c14ad5c0565a92447ec41992503262775b963ec8a.exe
Resource
win7-20240903-en
Malware Config
Extracted
cryptbot
Targets
-
-
Target
504d077daa7afdeab4134d2c14ad5c0565a92447ec41992503262775b963ec8a.exe
-
Size
4.3MB
-
MD5
eadb20865c939c361c835f8367e83ad8
-
SHA1
4a1ca5baf301951639c536b9b495efa49cd4b4b1
-
SHA256
504d077daa7afdeab4134d2c14ad5c0565a92447ec41992503262775b963ec8a
-
SHA512
070b123d5d1ff86c80e18d167372149cf631d3eb411cd82ce75319d0d21ad870727d284daf7e74bdd34898897aef2ff0e4ac055f8e40a4b0133faa158c3ec783
-
SSDEEP
98304:6DGBvlaixmb3UPwXl/Z4QjOMTbweJr7yd3:M8lai/QVZnK0
-
Cryptbot family
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-