Extracted

• • Target

    66e4a874645a4e5cffa45813dd5e6bc38dd218247ff784a0618a2d38bdb4a767

  • Size

    2.7MB

  • MD5

    459b0f64c3cb635a03af588adcb98077

  • SHA1

    af3573b5a9ae95d061bb2c0f262a7759b6d8c309

  • SHA256

    66e4a874645a4e5cffa45813dd5e6bc38dd218247ff784a0618a2d38bdb4a767

  • SHA512

    17a53247ea4514c66abb01cecdc44919d768905df56eb6a15361b84c7ea07edc329f48b266406997b40e218cc28ad26b3d295eb55067aa92c3d85e4573b8457a

  • SSDEEP

    49152:wrIYJCr5CDFd4A53p7o6xPsvjV3AW94ltRH8I1zRp6z7R6N:wrzCrGFd44y6xPi53AWutF7A7E

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealerthemidatrojan

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2