Extracted

• • Target

    SecuriteInfo.com.Variant.Zusy.579171.8856.10738.exe

  • Size

    6.3MB

  • MD5

    28c4ddcb51db3f5b035b9adf2f928d36

  • SHA1

    55d0b48a1cce7fbe071d714a7a52499454493c07

  • SHA256

    dd8a6f1c16306617a20eca9c3e24e1eb5feb7c28e8278a6fc7d904923e210a48

  • SHA512

    87fbd83781e622320fe0e9998ad09f4d5c27365c4f53ef722898136c3b90b9cfc6d45cf5f95c675aa602f5badaccedd9b7449aa793ed026d0016ba2a52f2708a

  • SSDEEP

    98304:wcr1g7xWdY61rSf0CUyLS/agF3vEHHj8WJY92yio3CRgxZs+SgpXLTl6:BXdSMZTFOYWFip

  Score

  10^/10

  cryptbotdefense_evasiondiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2