Extracted

• • Target

    random.exe

  • Size

    6.2MB

  • MD5

    f26b4d7cc2be7f4290585ebfaa5aa130

  • SHA1

    ceff08f33740d85ec2dbdfeed0760944f87ca0c8

  • SHA256

    c3768079ea8c8a3e288f83510ac109b9f1531ac8788584fc5971b80936a30773

  • SHA512

    2860fcbeb0cbc52a3088f1c65263320cbd72c8fcfdd7b5aa73be99e8dcde01079be4a7627e70a6a33a838a250a9b3441d421dbcd353872722a08dc67e4e8d23a

  • SSDEEP

    98304:7e8hyXkH2Sw3+mwpNs2zZlKo6JCEBPI16THCRiWnBat/YOwZ:vwA6Gy29UknBaG

  Score

  10^/10

  cryptbotdefense_evasiondiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2