Extracted

• • Target
    sub_d6255b4b18e6.bin
  • Size 750KB
  • SHA256 d6255b4b18e6f07c4708cf6344163dfe3197cf403957bf3085a6a737bb37b038
  • MD5 979d1d97ef97c7ae5737a88e87757ec4
  • SHA1 90d243cb67821975da1b13582476779eff5be9a5
  • SHA512 05c60e3714d906ea985a923ebda9e2efca17dfe29bfe9169f8e14f7053dd2871d9fa6bafb1d56919c07041be8841cfba82811ac1868398e2587ca25433727b4f
  • SSDEEP 12288:7RC0TWlTuoyPO3DwWUhREG4HR7cOIiatuSgw8ibKmYjoCM0G3Pll93USBfC:vWlTuzWNOiarzYjoj0G/ll9o
  • TLSH
    T1E1F4F1207790C434F5F652F849BA83B9A93C7EB06B3461CB62D52EEE46342E4AC31757
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverycryptbotspywarestealer

  • CryptBot payload

  • Family: CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2