Extracted

• • Target

    5215a50e992b411a73a9cb9dee51b39ce8b7505de7995bcba240e6f809b3696b.exe

  • Size

    4.3MB

  • MD5

    0c9fc2b51c7c604fd0bd9789f344cb95

  • SHA1

    c9dcd9ec34f73e7d109605f5b092e7f16be55bd7

  • SHA256

    5215a50e992b411a73a9cb9dee51b39ce8b7505de7995bcba240e6f809b3696b

  • SHA512

    264670682c48ce6ab59f62187f31b7afff4832c1ec0115b83864e6df8318b8c818c49ed14a54ef9c13abe30bc522ac6eba76ece5cb9a455ec8c47a64d22d2885

  • SSDEEP

    98304:dGz4NC30FzVzO37pp8vTUm66oGy7IvqGc8RZD5ieCXTQuGbov:dGz4Ny0FVzACTUm6LG6Ivp9ZIXcjo

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2