Extracted

• • Target
    file.exe
  • Size 4.3MB
  • SHA256 8ea91e731e0fce74fb28eda1544450236d309cce994e7b83f4c4ded006b6d5a4
  • MD5 44ab04adcd28ea330172ba9d008ae52b
  • SHA1 d70e7d1b90d5c6117ec2dd05e611ac1299c2dc00
  • SHA512 78bd2c57d66b71ed22f0c6910eed809e89e97837cbcfc478ffefbee8adb8f80de9dd4f2c226c4ed9bcaf7fb5788adf48edd42c5853992b22ee1661336b0f4d6b
  • SSDEEP 98304:u79KGoii1VtAGtLsErzsM8Dy8RHIzX+p/jgpNjHqvWYfpwuQViKosz:u79KOi7ZtL1rzsrO8hIzupSN9ksViKj
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  cryptbotdiscoveryevasionspywarestealer

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot

  • Cryptbot family

    cryptbot

  • Enumerates VirtualBox registry keys

    evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2