Extracted

• • Target

    5a249494869b3ef440bd31b438958585.exe

  • Size

    4.3MB

  • MD5

    5a249494869b3ef440bd31b438958585

  • SHA1

    d3c4cfbca5b8b1d061ac2f55899dfefc49321cff

  • SHA256

    0783ed26022f0e0f99d7e6b72ee2d7d7372c97596249299275cc19db7b10a8c4

  • SHA512

    4e53ada8f3d08d925c67e2019bfb2a8f9f3f3bb9aba0005e91daa792ae3c953d047a1b1b408bc01336a15476546abd8781baa4ff0258c2714ef436c05f221180

  • SSDEEP

    98304:xN0oUxjY0eMGO8d3mrO85fIj4qmmgXVJPD+gq1Ec8jE:xqVE1MNW4q9UD+gWr2

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2