Extracted

• • Target

    open-need-this-548.exe

  • Size

    9.1MB

  • MD5

    cb871641fdeeae993752fa4f5a9ce40b

  • SHA1

    c4ce33b0d1bd3793661ad46f4e89251fc98d8278

  • SHA256

    baaafe3a19db746baca67075a25066153cbe0bce08da3d536d9f76cd8182fd85

  • SHA512

    1ec42e576fb562296683ecdfb26e4818ad7580de626686baab5de728cc38ee79c8f78dbd8ad78e2bc465685804fd42aa188bfa06387a8cb321b9eb17f6586d5b

  • SSDEEP

    49152:K4RLvVjkP+8lZ3xp+q32Jc/APchP3Nz42XgYPxA2kUhUWQhboqxsKJb3HPyz8d72:K41G+8lVRmJgYch3RNwYqwSAKNyz8dy

  Score

  10^/10

  cryptbotcredential_accessdefense_evasiondiscoveryspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Detects CryptBot payload

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2