cryptbot | 27df222e178b40cf90c01d27a3b3443bc397b97620c1d55f740dce5279e512c7

General

Target
2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Size 865KB
Sample260328-e54vlaaw9s
SHA256 27df222e178b40cf90c01d27a3b3443bc397b97620c1d55f740dce5279e512c7
MD5 4486d799b94ab448ceb979628d0d5795
SHA1 ff7b9d7c25f473fcfe3f51fa18539e0d6257f30b
SHA512 35cafe23b8e637419f96530175b643e13beae70d7784ea5c5626e7c20faff0b33dbb3a7f9bf645c00c7d9da7c01a94341a456df186b72bf04ac0bfa2472c8b9f
SSDEEP 24576:upfuQ04A9W+FNI9u4nReU2Vc5tL6x/DdhX5pY+ptoS0:YGoQS9uX1XDXHY+pqS0
TLSH
T1D6159D82FFC290B0DB96217001F357F60E3676199B2199DFD2901A6A5A216F27B3F70D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cryptbot spyware stealer

Malware Config

Signatures

CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
456	2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
456	2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-28_4486d799b94ab448ceb979628d0d5795_amadey_avoslocker_cobalt-strike_cryptbot_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JfYlEaJhLbOpwB.zip

Path C:\Users\Admin\AppData\Local\Temp\ODnjOMjLl\JfYlEaJhLbOpwB.zip
Size 637KB
SHA256 1efe2bd506416d18c187d608370498344062c4e6dd2e5cb570c2549e83cb0e4c
MD5 773a1ba04716767bb472e42bb79bddca
SHA1 39cf55e3b83813ac07e24606d4642c84b01ea3c6
SHA512 adb2befbf7b97e6d3824844abc630284937194b17b3cc71e97c0946bfc9afbbb2e999440ebe830a0fb486ac406bd3fffec43bc4051169f3e729ce4d9d6ce66e6
SSDEEP 12288:IET6Sp6C4ys+9fsyaUX8FqsHKS8Vi3+soY38WUd1qWU9XAYS8tvbJZ:76dCc+9fsDUpsMcJIiWMS8tvbJZ
TLSH
T108D4239F74626AAE36E27DE1406D507FFB0889C035805ECB51D366093E83F9B346E1E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyFormat.txt

Path C:\Users\Admin\AppData\Local\Temp\ODnjOMjLl\_Files\_Files\CopyFormat.txt
Size 577KB
SHA256 9bc09b38e59731980e71a258e3f1632dfcfea83e62343b088455cb8ab89460ba
MD5 3302c2ccda6ba3a3a72abff39d4b68d5
SHA1 0bdfd28eb76620b2f7679b393a72b174dc7265ac
SHA512 88d6c047c15580093862be18a67dbdca974859cafa941b61378fc6ed5f984c0868eef7928cdfaebb352d8a995f0e30c51680666167f66e7d6bf447cf473bbb05
SSDEEP 12288:kPoQfo8wLxxQzXG4/OLyY5gAUtn/N+E3jRM/wdCr365:kPL5wUDT/OLy0g11N++ixm5
TLSH
T187C423B6F5E94E0CFEFCBA9F69012C7042D25291EA1E95FC3629CE5B4740029BD6490F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Information.txt

Path C:\Users\Admin\AppData\Local\Temp\ODnjOMjLl\_Files\_Information.txt
Size 4KB
SHA256 ff4ebe62ec806c07c5457ec7c747a4a3b87eab2040dd3d381224ca77968050e0
MD5 57413cd49ea44badc4c7b1e3652cbc9a
SHA1 9c5c0f2e377a59e6f72bd36d9001df1e53c5cfba
SHA512 c3069660f9b4bdf232e872956aa65f09db73f1a295eee43cf3423038166ac8a767225cf3a7afe8b75857695c55354ce027d49ed5db426e0576d76f01bc88cbde
SSDEEP 48:sx6sdUoaOteXxhaMSzcehGYTwTCuDQeDe7iGqXpF88be7HHcBOmjmcn+jYyrJB4b:sHdUbOteBkyn3QyDDMHcVmcnmB4McR
TLSH
T1478136290BE44316E5B6AB11ADF04863B57B3855ED74CB4D01EC630E87A3D22E874F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Screen_Desktop.jpeg

Path C:\Users\Admin\AppData\Local\Temp\ODnjOMjLl\_Files\_Screen_Desktop.jpeg
Size 80KB
SHA256 e9b71803c2e3c62a62d83e6612e4f3c3127e95d3f8ffec5d825bce427795a231
MD5 d02d0a0401dba45dee1ca47c50690420
SHA1 36140d757c112a885ad3ef0701b5ccb63e54277b
SHA512 e476aafe29ad6224beb2780b69b60c07f44bdcb0a19309aedb0587f1b47b469e64f92d6bc1f750649e14665e58bfb99b0a2b7d30d662e8176de46a8d0a4e130d
SSDEEP 1536:SKeany89lYjR5JdTlWTm0noWLYMPza8MlPmgZzzzzzzzzvXq:vekp9GjR5JB4TyWM/u
TLSH
T173832207DD0D8683E02897F9BD434DAD2F192A1DF9923AFE55221ED73E602225C4F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\ODnjOMjLl\files_\system_info.txt
Size 3KB
SHA256 577333befc2ebde9f4aa9421712e4968730f79ae670d8c2a30710667c29a0555
MD5 c77d642a525f79b24e9df91982e5a5fa
SHA1 c78e3baa1806d03304fa9aed8f86ae3c85da7cc3
SHA512 cb62d09f0a29cab697a33eaa754cecc0e33759d761771e13581d4a6671dc5bef18eaec5d95b35d86ea77fd69445dabc9a0e430e319a7a6d5ae0f61aad8715e9d
TLSH
T1BD7134190BF44316E5B69B11ADF04863B67B3851ED34CB4D01EC620E47A3D21E864FAF
MD5 SHA1 SHA512 TLSH

Submit Download

system_info.txt

Path C:\Users\Admin\AppData\Local\Temp\ODnjOMjLl\files_\system_info.txt
Size 8KB
SHA256 043f79fb70c4d351546e9d1656028504c5b65bfbf1b2774d4fba608082f3b445
MD5 f5f6f6d2a8272bdb4336b548329dd4e3
SHA1 e9e36a7301f394d53534234645c423619725eab8
SHA512 b0b62b60a7079c5ec37840cf2adedb67ce9d7230474f5f703e025e92679395a55c7acddb9d4b03265f12e65674cc8581b522b2e874660a8b6ff315cab7912040
SSDEEP 96:qdUbBtewEyTgKDDMHcVmcnmB4Mcq4hkN346wzBt96cnhrcn1wcfsoByYs:qdUbCRyTgD95NlTUbT
TLSH
T1B902032C0BE44B15E1B2EB119DF00853B57B7856ED74CB8901E8634E87A7D12B864F9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-222-0x0000000000C60000-0x0000000000D5E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads