Extracted

• • Target

    a8750b5975e3f52c9285f811e9fe22cf19cc9b097fd96ee945623965c613a385

  • Size

    5.4MB

  • MD5

    7bee3a8f387bbbc84ab90a8a92be6dc6

  • SHA1

    d93b5a47af4094bb8d900a8a6feb89bcbf38c118

  • SHA256

    a8750b5975e3f52c9285f811e9fe22cf19cc9b097fd96ee945623965c613a385

  • SHA512

    95cbe2ed9005342fa1caf3a192f636fd9c8ef64df8f7baaeb09a701c209ef139da90e61a1fd24efef0c4d078706a8acdc082ac7b3f5c138ca5341d6b829846af

  • SSDEEP

    98304:ZsskiQvHYE7PyrHXIJ1zqRfm0zWPReVl23hIJyNm4/acqTsg:wiyYaH1q9z6eVlPJygsg

  Score

  10^/10

  cryptbotdefense_evasiondiscoveryexecutionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2