Extracted

• • Target

    c82982222ee6feb4c7cd67717a0574ed2e9ff2e8c8ae24b4d21ba54368ef161c

  • Size

    4.1MB

  • MD5

    7376bc47854cda3c703270dd5b9a9bbf

  • SHA1

    ea0826be675d1432112137e125a7dbb088b41eac

  • SHA256

    c82982222ee6feb4c7cd67717a0574ed2e9ff2e8c8ae24b4d21ba54368ef161c

  • SHA512

    5d6a5fec7bade339bdecd4aae5c9fdadd07ae48fd9d18097f970c2d29b5e133a6f6a134fc07e57eba0c1cd4aeffc1aa2af2891db9d0c9a6b3b2a9b9d52a7115a

  • SSDEEP

    98304:Zs7iVwJeAmhW07wS72z5H5VTxT/NuMTMjMYe:oiVtDx7wS6lH5NxTUoMjZe

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Enumerates VirtualBox registry keys

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2