Extracted

• • Target

    open-need-this-707.exe

  • Size

    8.3MB

  • MD5

    2761863597a1e22c894a88265eb6fdbb

  • SHA1

    3814875979acf7329d70957a208659528a4c83c6

  • SHA256

    cd5fd68c44426d71df9bbd25c62b425932f9c2e1d5fe020e70ee1b73e3af5292

  • SHA512

    2fccf5a720f70a9091ccd31fb1c1f5a5f7d52cf89d0e7fe79028f18c56285d4465cd674f85266dbdceb1ec561dadbc831a2da37fa9a0c3cf3bf7f677d3ebca4b

  • SSDEEP

    98304:pn8Yxk5fQ4RtDc7lIwd9ISwOnSKXyz8Xa:9S5Y0tK6MnnS8G8Xa

  Score

  10^/10

  cryptbotdefense_evasiondiscoveryspywarestealeradwarepersistenceprivilege_escalation

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2