Extracted

• • Target

    95b7a961a634c972681d935cf4f78150c0e2f0d962daa3daf59c3fd3af714db2

  • Size

    3.8MB

  • MD5

    3db1c66a1e51f7c1e258b1c12205a435

  • SHA1

    98e24a9ea6e7c38a95543c89a037c7f3f7b1591c

  • SHA256

    95b7a961a634c972681d935cf4f78150c0e2f0d962daa3daf59c3fd3af714db2

  • SHA512

    7bec8f484f8f047d84d6f703853a56cbffa061ab22813e9449fa78382a88d9f42a27eb1f999e1e7ab30597afb49e2ff5c23f65654c4584fc75d1c2835607a407

  • SSDEEP

    98304:ZsFwe8EuILKpQN0d7aePKtGBz/smtrm+2f/VSnGIm+LR4ZzK:FEoO01aFGBz/sYK+2fIGImy

  Score

  10^/10

  cryptbotdefense_evasiondiscoveryexecutionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2