Extracted

• • Target

    897b0a99718bb1cb83242a09fa9542572aae3a5d2d4a5c90b6bb4be334131876.exe

  • Size

    4.3MB

  • MD5

    23a5d24635b116f7ff8a1835275027de

  • SHA1

    3a47b6b89b789387e951e452ca2bf169c4cd0c3a

  • SHA256

    897b0a99718bb1cb83242a09fa9542572aae3a5d2d4a5c90b6bb4be334131876

  • SHA512

    d4ebdedab89e6a85457c7ffa5407cbfb199b7ba117ef49c1c8027abaeb5c56cb3c532dd1739b755df5157811fbc7d18e9f95e0d011f94825403090d714663677

  • SSDEEP

    98304:6EY9Gce3J/R37n7jcZOcLPGObJjGk1m1S0H2Ue0K7JDDYkpq+FUpJQpH:qGR3J/R3r7j8ObObJjGGOLWj17J/t8+V

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2