Extracted

• • Target

    85aca9b9c7eed56fcd7f62f7775c4e16555532497a7a657a8973f7dfc9e791ca.exe

  • Size

    4.3MB

  • MD5

    3657bc0028f37da206a1530aa895f62e

  • SHA1

    b23e3ac015967159f244b2ab5dde165232a797d9

  • SHA256

    85aca9b9c7eed56fcd7f62f7775c4e16555532497a7a657a8973f7dfc9e791ca

  • SHA512

    589a567fa6943180b4fb38e32ffdb9d78975feb65f1e1369437753857199eebb2f6383e1248f3d1ad526df92b2a96d2d46c2fd8d9939c44e7e95354582f24c07

  • SSDEEP

    98304:gvgc3jdMcGy7WYVV09ol4PGUA8Dj+ibl3cQKRMoEUVKFo:gIc3jdMLsdV0eCXFCQAhg

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2