Extracted

• • Target

    9a9a0a2d9375d6f207af97df95e0762f.exe

  • Size

    4.3MB

  • MD5

    9a9a0a2d9375d6f207af97df95e0762f

  • SHA1

    0c7a9c093c2e1c68c77582e5f7acab8fc10505f3

  • SHA256

    77953741b91b2deef3dc7e168cf072cda89e92a60ca0ee82c37a4bbb4d4d0abf

  • SHA512

    048ce614023621feda7e765b9d5ac4a49cd3f55cce4c56d827e96abb521a66e0c59a9bae9e521e8144be04d2f0c0fc2f5e55a214405d516630a4422018873c01

  • SSDEEP

    98304:fFaMLDBg4+I5t3ZNXGRCoQSL9/g7wqwEdbnFUp:fPLDBgGFPXux/g7wnEd7FU

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2