Extracted

• • Target

    1149dc52a38ac45de7ba2d62192c2918.exe

  • Size

    4.3MB

  • MD5

    1149dc52a38ac45de7ba2d62192c2918

  • SHA1

    cb07a903a94b3d04813ae3ce1b24d48ddfb970ed

  • SHA256

    0b7e5470a3e798aeb45bf3e5abfa0873031828744b92ecca69ea3594db368237

  • SHA512

    2b772cd00d5cbc87cae39416c960f792740d82f9871e8d860841f3b49ecbb2aa9ba8f4d9dd6f1355a21387a5e25eeac18eae9ed4448c657c58533d9bce0ce299

  • SSDEEP

    98304:qaEbHfDFIUF0EqFRAFLlMY1bOjU0FH2SlbzF45ltBO47/WBK:qaEfFIUF0pgMYr82QF4ft0w/Ww

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2