Sample name: | SzXZZDlkVE.exerenamed because original name is a hash value |
Original sample name: | ef6018bf916cec9358b260a243e92469.exe |
Analysis ID: | 1580285 |
MD5: | ef6018bf916cec9358b260a243e92469 |
SHA1: | 9231767baa77dde01cd6ec06adf48904607d731d |
SHA256: | 963630b9846e75467f4275f9932259def3f690e0e0909d63d956bf472613f98e |
Tags: | exeuser-abuse_ch |
Infos: | |
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
CryptBot | A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. | No Attribution |
|
AV Detection |
---|
Source: |
Avira: |
Source: |
Malware Configuration Extractor: |
Source: |
Virustotal: |
Perma Link | ||
Source: |
ReversingLabs: |
Source: |
Integrated Neural Analysis Model: |
Source: |
Joe Sandbox ML: |
Source: |
Code function: |
8_2_003C15B0 | |
Source: |
Code function: |
8_2_6C1414B0 |
Source: |
Binary or memory string: |
memstr_8e4985f8-5 |
Source: |
Static PE information: |
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior | ||
Source: |
File opened: |
Jump to behavior |
Source: |
Code function: |
8_2_003C81E0 | |
Source: |
Code function: |
8_2_6C1BAEC0 | |
Source: |
Code function: |
8_2_6C1BAF70 | |
Source: |
Code function: |
8_2_6C1BAF70 | |
Source: |
Code function: |
8_2_6C160860 | |
Source: |
Code function: |
8_2_6C16A970 | |
Source: |
Code function: |
8_2_6C16A9E0 | |
Source: |
Code function: |
8_2_6C16A9E0 | |
Source: |
Code function: |
8_2_6C15EB10 | |
Source: |
Code function: |
8_2_6C164453 | |
Source: |
Code function: |
8_2_6C1E84A0 | |
Source: |
Code function: |
8_2_6C16C510 | |
Source: |
Code function: |
8_2_6C16A580 | |
Source: |
Code function: |
8_2_6C16A5F0 | |
Source: |
Code function: |
8_2_6C16A5F0 | |
Source: |
Code function: |
8_2_6C16E6E0 | |
Source: |
Code function: |
8_2_6C16E6E0 | |
Source: |
Code function: |
8_2_6C1E0730 | |
Source: |
Code function: |
8_2_6C160740 | |
Source: |
Code function: |
8_2_6C1BC040 | |
Source: |
Code function: |
8_2_6C1BC1A0 | |
Source: |
Code function: |
8_2_6C19A1E0 | |
Source: |
Code function: |
8_2_6C160260 | |
Source: |
Code function: |
8_2_6C214360 | |
Source: |
Code function: |
8_2_6C1BBD10 | |
Source: |
Code function: |
8_2_6C1B7D10 | |
Source: |
Code function: |
8_2_6C1B3840 | |
Source: |
Code function: |
8_2_6C16D974 | |
Source: |
Code function: |
8_2_6C199B60 | |
Source: |
Code function: |
8_2_6C17BBD7 | |
Source: |
Code function: |
8_2_6C17BBDB | |
Source: |
Code function: |
8_2_6C1BB4D0 | |
Source: |
Code function: |
8_2_6C16D504 | |
Source: |
Code function: |
8_2_6C1B9600 | |
Source: |
Code function: |
8_2_6C16D674 | |
Source: |
Code function: |
8_2_6C1B3690 | |
Source: |
Code function: |
8_2_6C16D7F4 | |
Source: |
Code function: |
8_2_6C1E3140 | |
Source: |
Code function: |
8_2_6C15B1D0 | |
Source: |
Code function: |
8_2_6C16D2A0 | |
Source: |
Code function: |
8_2_6C1D7350 |
Source: |
Memory has grown: |
Networking |
---|
Source: |
Suricata IDS: |
||
Source: |
Suricata IDS: |
||
Source: |
Suricata IDS: |
Source: |
URLs: |
Source: |
HTTP traffic detected: |
||
Source: |
HTTP traffic detected: |