Extracted

• • Target

    96bfc7cc6faec266f2d88ef07b0aa1557cdca954f9b1d00b382c049ce102c8ad

  • Size

    3.8MB

  • MD5

    39cb29174e8067eb57cb628d7debb3ec

  • SHA1

    489a3762aff2b43e86f80f482162702fa7405588

  • SHA256

    96bfc7cc6faec266f2d88ef07b0aa1557cdca954f9b1d00b382c049ce102c8ad

  • SHA512

    6662cdaaff15575c7ea7094803b6ea3ac3258b78f6a26b0849d69ae82e1a6075092b605adb9ba02e92440515bdb4cf67343c6c74f685b8271090164a1797bba0

  • SSDEEP

    98304:Zs/kiQvHYE7PyrHXIJ1zqRfm0zWPReVl2E:3iyYaH1q9z6eVlt

  Score

  10^/10

  cryptbotdefense_evasiondiscoveryexecutionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2