Extracted

• • Target

    37f98020a18c5349391aa444259fbe0e33133b612ea1a52612415a484e761064

  • Size

    3.8MB

  • MD5

    1e9f66938dc65ea07276d1eb137ab047

  • SHA1

    c9d9c8d5069af1689668157fc178bfa947469b97

  • SHA256

    37f98020a18c5349391aa444259fbe0e33133b612ea1a52612415a484e761064

  • SHA512

    00a217e5ce5a9ce4748054dbe82d887a67083f369c59341b9c5459402b871e4180f1455c5197408ea76989dc8e809157cc7c36ead3813048f6313ad226537d81

  • SSDEEP

    98304:Zspwe8EJfdMgg3akDFJBXy2vRfcSpwxzYs7kjhn/JU:zEJfOhqI+2ZU0IBkjhnRU

  Score

  10^/10

  cryptbotdefense_evasiondiscoveryexecutionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2