cryptbot | sub_24336a3c69f8[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
sub_24336a3c69f8.bin
Size 267KB
Sample260524-b59jashx2v
SHA256 24336a3c69f863981df13cc9c2cc8fe002d642962fc1d12c87062a8e5d273889
MD5 ce49df0ba4bddeb9ad1380a5b7e9331b
SHA1 36ccbc79c8bae4db35e280761a1d70aa56098295
SHA512 f3feba078a35b90405eef83771d68a11fce43e35446d97835ad0f0ddc5f7bb7a1dc9ca4364d1d9320c96606b86e646561eda637cf3c4f24c005d21b81011ff52
SSDEEP 6144:gWMjIwAafnNLPJWvVsybC2DTTvmp7gC4skNlu4MsKIwax:gWMjIwRfnNTJWvVs/2D/vmpwskNlu4Mo
TLSH
T177444C017990C131E77196322A799F7185FE7D389E7062CFA7800F39DA316D2A925F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

spyware stealer cryptbot

Malware Config

Extracted

Family

cryptbot

bridmz52.top

Signatures

Family: CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sub_24336a3c69f8.bin

File Explorer

sub_24336a3c69f8.bin

.exe 267KB

sub_24336a3c69f8.bin

IMPHASH c558b851580d3599e6409335ff1479b7
SHA256 24336a3c69f863981df13cc9c2cc8fe002d642962fc1d12c87062a8e5d273889
MD5 ce49df0ba4bddeb9ad1380a5b7e9331b
SHA1 36ccbc79c8bae4db35e280761a1d70aa56098295
SHA512 f3feba078a35b90405eef83771d68a11fce43e35446d97835ad0f0ddc5f7bb7a1dc9ca4364d1d9320c96606b86e646561eda637cf3c4f24c005d21b81011ff52
SSDEEP 6144:gWMjIwAafnNLPJWvVsybC2DTTvmp7gC4skNlu4MsKIwax:gWMjIwRfnNTJWvVs/2D/vmpwskNlu4Mo
TLSH
T177444C017990C131E77196322A799F7185FE7D389E7062CFA7800F39DA316D2A925F3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90174

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetComputerNameW GlobalMemoryStatusEx GetFileSizeEx UnmapViewOfFile CreateFileMappingW MapViewOfFile ReadFile WriteFile SetFilePointer GetFileInformationByHandle FileTimeToSystemTime GetLocalTime LocalFree SystemTimeToFileTime WideCharToMultiByte GetTickCount GetPrivateProfileStringW ExitProcess SetEndOfFile WriteConsoleW HeapReAlloc HeapSize FlushFileBuffers GetStringTypeW GetUserDefaultLocaleName GetSystemInfo CloseHandle FindClose Sleep GetFileAttributesW CreateFileW LocalAlloc GetLocaleInfoW GetFileSize GetModuleFileNameW RemoveDirectoryW FindNextFileW FindFirstFileW CreateDirectoryW CopyFileW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation LCMapStringW DecodePointer CompareStringW GetTimeFormatW GetDateFormatW ReadConsoleW SetStdHandle ExpandEnvironmentStringsW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwind RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetStdHandle HeapFree HeapAlloc GetFileType GetConsoleCP GetConsoleMode SetFilePointerEx

user32

GetKeyboardLayoutList GetSystemMetrics GetDesktopWindow

advapi32

GetUserNameW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW

shell32

ShellExecuteW SHFileOperationW

wininet

HttpEndRequestW InternetOpenW HttpSendRequestExW HttpAddRequestHeadersA InternetConnectW HttpOpenRequestW InternetWriteFile

crypt32

CryptUnprotectData