cryptbot | 27df222e178b40cf90c01d27a3b3443bc397b97620c1d55f740dce5279e512c7

General

Target
2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Size 865KB
Sample260328-e54vlaaw9s
SHA256 27df222e178b40cf90c01d27a3b3443bc397b97620c1d55f740dce5279e512c7
MD5 4486d799b94ab448ceb979628d0d5795
SHA1 ff7b9d7c25f473fcfe3f51fa18539e0d6257f30b
SHA512 35cafe23b8e637419f96530175b643e13beae70d7784ea5c5626e7c20faff0b33dbb3a7f9bf645c00c7d9da7c01a94341a456df186b72bf04ac0bfa2472c8b9f
SSDEEP 24576:upfuQ04A9W+FNI9u4nReU2Vc5tL6x/DdhX5pY+ptoS0:YGoQS9uX1XDXHY+pqS0
TLSH
T1D6159D82FFC290B0DB96217001F357F60E3676199B2199DFD2901A6A5A216F27B3F70D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cryptbot spyware stealer

Malware Config

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1860	2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
1860	2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MoRvcJnPJCiamw.zip

Path C:\Users\Admin\AppData\Local\Temp\SexXNOpgCXsG\MoRvcJnPJCiamw.zip
Size 59KB
SHA256 07159ff0838513c28ec8b6746c51487333516620d3dc1e9aee089394c020e82c
MD5 8093820830ec941b33d935251557275a
SHA1 73017fb787c349f756ac4ad6683b1f53616ae18d
SHA512 04089a9a22a20d1c9b0abf0dc9e8f2bc6455909548ec1c0c41bf101aef09af8829e6f8f2226e9ece0f068fbc429315cc2e13658528b643b52b793cbe8eeb72f3
SSDEEP 1536:Me/JIEWSvX04IabHwpyoMkkdeBa7n+lxjPTXxRJ+GhoY:Me/vvk4DUnVapn+lhPFRc+oY
TLSH
T1865302EE63109D61D76BAF96560539B826A3BE1AC61CCF07753CC0C6A8CC706E4329C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\SexXNOpgCXsG\_Files\_Information.txt
Size 1KB
SHA256 e6b406fdb187cbd6158a9f0794213b876bbd46226d5fc3b786c943bd7d7fbd2d
MD5 a978420e0cca1143e6a9269a201e303a
SHA1 a0b275fccab9a1a819bb6cee8ad2ffe2ea5d0fd3
SHA512 9a8d45d0587773603a1bfe13d4103509d3aefb0d8d9f3a1797ad2d4dc3182ef75f2cce613e22bd1550cf1301de221dbf5306d0ed0eff303597e7c4a6ecd8570b
TLSH
T13D41201A5BE40214F1B7EF02ADF20423A6BB3DA06C38C95D10CC820D47F3925E824BAB
MD5 SHA1 SHA512 TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\SexXNOpgCXsG\_Files\_Information.txt
Size 4KB
SHA256 a69a9b909acba9344e310d8a6062b32b06094ddc8b46fbd2d0df5a5cc91bbe86
MD5 6793e1e3f0a6df608d962e58aa088a6f
SHA1 757d638feb5cbb86bfae41a43105ec23be61b8f0
SHA512 fbe165309607ca4d694200f3400c07b28aa7000aaf13cdf9ab4228e3568651456e23c3d30524074a5c619c1d2396512eb7e2eaa8b22c236ede8a7df638521b27
SSDEEP 48:sx6sdUoaFUteXxQaMGehGYTwTCuDQeDe7iGqXpF88be7HHcBOmjmcn+jYyrJB4Mu:sHdUbFUteBnn3QyDDMHcVmcnmB4Mcq4
TLSH
T195A148191BF44716E5B2EB10ADF14813B57B7891EC74CB4D01EC620E87A7D22A864FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\SexXNOpgCXsG\_Files\_Screen_Desktop.jpeg
Size 77KB
SHA256 aa259c506c4a70a03b75b7ad923c1acb42b0a5719ceb6e4bf5c011d2b610d7c7
MD5 6646f523144e976f9af938a5f3587447
SHA1 2896dbaf3ee0aa40e24ca9f55d4475d5a197046a
SHA512 1f502263b6fc2c4900c01804c9fcc4972be3429de3f83269750f95dd2c20fb19b2201bdeada5675361cd08a4e21d32941096344cbaa10c4f7c2b16a02421ca51
SSDEEP 1536:SqQjfNM+N3gGQVJ9Wx5ARIIpKlCX1Xk2euFFmX6TUaSTvC31:Tqfra9KPF6HSTvC31
TLSH
T111734817CD089B83A02957E8BD070EAD6F492B0CE9923AFF54275EC77D202261D4E16F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\SexXNOpgCXsG\files_\system_info.txt
Size 1KB
SHA256 769a485797ea8d3067e703100417b96f00c86bda6dcc0dbffeccddc950baf0d7
MD5 eda37a82b8bd7ac98406df66ca8b377e
SHA1 e1099c07d5b54a15d90a0a6f1dcad786d2778017
SHA512 e37cda00dfff21a13081d1512b68b4fc9621ddfd883267db48ea2e306cc3d981922026654bb817a5cae21186ea013368f81a4af9b8baac0a524078c8bf18a953
TLSH
T16A31D3165BF80115F5BBAF026DF6446257BB7DA03D35D41C11CC960C0BF3A15E924BAB
MD5 SHA1 SHA512 TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\SexXNOpgCXsG\files_\system_info.txt
Size 8KB
SHA256 8ed0fc72703187740ab01c42ea160e1f88526cd81e8c5128818c4268f91adb98
MD5 b87009fbbda5d6930539ad6f087ae2c5
SHA1 26f905e74b5d8861925f096b69e7d82b707f1b78
SHA512 0e0a31efdf1bef5da8dca1662954e20fa0bdd3b9a8d94d12259d1beedb18edb1ea04f02d5d41942d94f9dc6817efc86c6d0dd26b2a514fafa3f2867f150ab349
SSDEEP 96:qdUbGYtewmTgKDDMHcVmcnmB4Mcq4hkN346wzBt96cnhrcn1wcfsoByYs:qdUbq7TgD95NlTUbT
TLSH
T15F0203280BE44B16E1B2EB119DF00853B57B7856ED74CB8901E8634E87A7D11A864F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads