Extracted

• • Target

    b4de967276c1b66e49f92d673b4a627294bd16709c50ee8372aaf7b5d67ad632

  • Size

    3.2MB

  • MD5

    367d6d7210344d513037c0d9ad6c1094

  • SHA1

    e562cd450ea66a3703d77d4c0bf332bf934d7113

  • SHA256

    b4de967276c1b66e49f92d673b4a627294bd16709c50ee8372aaf7b5d67ad632

  • SHA512

    73c1a7b7e224eaee94212c8ec1fa2a3bc0ccc474aaf71720d1dcb75564edde244efec7055ee35aab7e64197fbc9c063ab1a7d08bf0625fcda06f6dd361347dad

  • SSDEEP

    98304:ZsjlFDYPY3lEpOBunjPTgO2WDg2STyH7eaoN14:GFD/2jPTUWfSObeRN14

  Score

  10^/10

  cryptbotdefense_evasiondiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2