Extracted

• • Target

    234720e696e01f3e21f6d0888a906a186ed6bfcc1b416bf5e6b78ba7ebc49474

  • Size

    3.8MB

  • MD5

    52dfbec82ed8b0f36065b6c7dd60db74

  • SHA1

    da386493a3cdee427b90b9d61a32a53a1cf7c097

  • SHA256

    234720e696e01f3e21f6d0888a906a186ed6bfcc1b416bf5e6b78ba7ebc49474

  • SHA512

    077c226c12525c17d178522cb123322fe37067ab7211402fa56f207ad793778dd54a3a6e594811d502fa2fbffee65e7488b7cf3c24936c1e9b7c28d3d2fff225

  • SSDEEP

    98304:ZsLhipLqAerp+/fe6maWwtZ96QWkcsL9ydhhy:gipmHp+/26ma7tZFAdy

  Score

  10^/10

  cryptbotdefense_evasiondiscoveryexecutionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2