Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
CryptBot | A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. | No Attribution |
|
AV Detection |
---|
Source: |
Avira: |
Source: |
ReversingLabs: |
Source: |
Integrated Neural Analysis Model: |
Source: |
Joe Sandbox ML: |
Source: |
Code function: |
8_2_00B115B0 | |
Source: |
Code function: |
8_2_6C0D14B0 |
Source: |
Binary or memory string: |
memstr_495101a4-0 |
Source: |
Static PE information: |
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior |
Source: |
Code function: |
8_2_00B181E0 | |
Source: |
Code function: |
8_2_6C14AEC0 | |
Source: |
Code function: |
8_2_6C14AF70 | |
Source: |
Code function: |
8_2_6C14AF70 | |
Source: |
Code function: |
8_2_6C0F0860 | |
Source: |
Code function: |
8_2_6C0FA970 | |
Source: |
Code function: |
8_2_6C0FA9E0 | |
Source: |
Code function: |
8_2_6C0FA9E0 | |
Source: |
Code function: |
8_2_6C0EEB10 | |
Source: |
Code function: |
8_2_6C0F4453 | |
Source: |
Code function: |
8_2_6C1784A0 | |
Source: |
Code function: |
8_2_6C0FC510 | |
Source: |
Code function: |
8_2_6C0FA580 | |
Source: |
Code function: |
8_2_6C0FA5F0 | |
Source: |
Code function: |
8_2_6C0FA5F0 | |
Source: |
Code function: |
8_2_6C0FE6E0 | |
Source: |
Code function: |
8_2_6C0FE6E0 | |
Source: |
Code function: |
8_2_6C170730 | |
Source: |
Code function: |
8_2_6C0F0740 | |
Source: |
Code function: |
8_2_6C14C040 | |
Source: |
Code function: |
8_2_6C14C1A0 | |
Source: |
Code function: |
8_2_6C12A1E0 | |
Source: |
Code function: |
8_2_6C0F0260 | |
Source: |
Code function: |
8_2_6C1A4360 | |
Source: |
Code function: |
8_2_6C14BD10 | |
Source: |
Code function: |
8_2_6C147D10 | |
Source: |
Code function: |
8_2_6C143840 | |
Source: |
Code function: |
8_2_6C0FD974 | |
Source: |
Code function: |
8_2_6C10BBD7 | |
Source: |
Code function: |
8_2_6C10BBDB | |
Source: |
Code function: |
8_2_6C14B4D0 | |
Source: |
Code function: |
8_2_6C0FD504 | |
Source: |
Code function: |
8_2_6C149600 | |
Source: |
Code function: |
8_2_6C0FD674 | |
Source: |
Code function: |
8_2_6C143690 | |
Source: |
Code function: |
8_2_6C0FD7F4 | |
Source: |
Code function: |
8_2_6C173140 | |
Source: |
Code function: |
8_2_6C0EB1D0 | |
Source: |
Code function: |
8_2_6C0FD2A0 | |
Source: |
Code function: |
8_2_6C167350 |
Source: |
Memory has grown: |
Networking |
---|
Source: |
Suricata IDS: |
||
Source: |
Suricata IDS: |
||
Source: |
Suricata IDS: |
Source: |
HTTP traffic detected: |
||
Source: |
HTTP traffic detected: |
||
Source: |
HTTP traffic detected: |