Extracted

• • Target

    35c5a257003e97599dd1b1bc6936ccfb7d57235903aeecfb3ee9d7abe5fee3c8

  • Size

    3.2MB

  • MD5

    a14510e62298e461bd64b7a75b7629a6

  • SHA1

    6bc9fd3d4fda53786fe48d41c5a6fb3e57f227af

  • SHA256

    35c5a257003e97599dd1b1bc6936ccfb7d57235903aeecfb3ee9d7abe5fee3c8

  • SHA512

    10682f5347ad26646bfc631c50f116d0657e28c41149a6c18b8da34fa52ffdfadbe8c46a4266640f977738964d8fafea90ea375f6e2a17395f8ef109eb186a2c

  • SSDEEP

    49152:ZsvoQtzPIM6eHLwp8gauv2DAgJtYGwxFe7LD4gyoz+U+IIKQMt91TrzSjjdDG9:ZsZzPpbrcvngJtYOD5+U+6nTCFDG9

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2