Extracted

• • Target
    2026-04-05_1a23caa1e92fddce999e6a6b450ea23a_amadey_elex_glassworm_icedid_njrat
  • Size 6.1MB
  • SHA256 b486253e644952802ffbad53e73a914eb7cd2b122fa1d54dc3913f98e2358895
  • MD5 1a23caa1e92fddce999e6a6b450ea23a
  • SHA1 affdda9e7c045bf0fb4399c71e94f376bbb6d169
  • SHA512 d6dbdcd802d4206e47b466258d30307d407e1102a707004f09dea2bff6b7996883fb51a06a8bf1c29dcd34a256dc9d631a3e4756be42ceefc4e652c517104121
  • SSDEEP 196608:y3yzq2SeXkTXHf7f7OHVMUlv9tYS7Nbr:Iy22StTTzANlN
  • TLSH
    T13156F157EB915AD8F79D09366B584150DB2EF261AA4F2320782C520CCF8738B8F65E3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverycryptbotspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2