Extracted

• • Target

    764767d6adf6fa8a9c0b437d79a7a973.exe

  • Size

    4.2MB

  • MD5

    764767d6adf6fa8a9c0b437d79a7a973

  • SHA1

    f06803c1321e1b613f494e337a3e7b6c11f2e880

  • SHA256

    f938e11a28c63ca465cec4151a02add7ff1f534d31eb8ad1e4e765620da43762

  • SHA512

    961330c1e2c92edcce9c845e1c038215c772b5b838785d4fccfd54a037c7145341edfc8a0ce560166d4adddf066289691ec4176b43d559b2b0da9eac7b4cd3ef

  • SSDEEP

    98304:x9GpNaOCU/IL0l0xW0Qs/Sy2rETtfzX13+BYoL2:x9GpN55UW0QIAriJ8Yo

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2