Extracted

• • Target

    2ce78ac3287a074e14bd8b4af226fd09.exe

  • Size

    4.3MB

  • MD5

    2ce78ac3287a074e14bd8b4af226fd09

  • SHA1

    58500a1a439de84a870031062dd51e7cae982987

  • SHA256

    942897e237bc3ab9b597d9258e2541730d2192b957ea21c6242dc373b42dbc8f

  • SHA512

    1b403b7937bd6a32ed8a78bd29794b280f953a7ba222d64d9ef7359107f7d844ae66dbd432375eabf1837405bd700e2bad22af574fedb9f66c789db6d8419205

  • SSDEEP

    98304:kXIT2VmtAS1S0vAiEXRAcd6+7d+kFod8iO5SP34mzaNGfec:kYT0mvfv/nc7Qd8iO5oImzaE

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2