BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details

CryptBot

59
Global rank
16 infographic chevron month
Month rank
12 infographic chevron week
Week rank
0
IOCs

CryptBot is an advanced Windows-targeting infostealer delivered via pirate sites with "cracked" software. It has been first observed in the wild in 2019.

Infostealer
Type
Unknown
Origin
20 December, 2019
First seen
14 September, 2024
Last seen

How to analyze CryptBot with ANY.RUN

Infostealer
Type
Unknown
Origin
20 December, 2019
First seen
14 September, 2024
Last seen

IOCs

Hashes
b06bf1b489aa7448b29376668aeb17392f2a266246010933b9fa38548c146d57
3702545380cc94efb02c0e020aaff80372029e73dd5896bbeff74bf343ea90a6
88480be3d2058784c6005e4e0daef5f963087c3c05e50576f523ef8b0a8d5311
77fc615d57ff8dd7ecba975d0d123f402f8affe373795bdad12906dc139ccf82
3535e7e1ad38eee042810aaff97714f09e22ebfbc3f2c47f829798bfc7f594e5
288fbffb2e9d8a1143f48e3f31514f2f2b861ddb8382aa6da0f194286a653ad2
4407ff2a4e5241f537e1abe25f13557136f90d6b56df88243f5489a3c6614671
3cf195cbc51f60067352512b16f9a7997645ae2c8c7e6317ab6fac2a4cace751
2016ebadc00e52c233385aec716c354bfe4dc0410128c03a7eedd6866751865d
e4e05237ea41e532eaa305197ae080f0bbf1769aaa30920c9797457f013d28bd
52a70a809294561f69bb7016818e295779d8e00c797097cf77d534ed3a07dd2c
032e2a98c1a8d6e2a2353da6dd105bf572f3d65a4c99aa25083e3eb12069b92e
f852161c46e2b5edd38cd552562afc7a5d14435d1a6a373a87ca18df2ebc76c6
4cb21265ed5d9fe786973cea7b7b13ae44f6cbc455ddd862b9a6c6c5acd34edc
863fd040cd49ddf902538a66cd9cbef63b35f36da1066cbba4a51483dde7113a
e8cacbdddd06d4d9ea2106a3699233848ba87b262f38033ab1eee8aa3cded3a3
3e792c85baf34c86b8d4b89d558e2b0c44a96ef6fa87d054b6fd154fc58ec34b
840be0805a6ee65643b63f5cc5a22eb50a42dac2cf29c9040b8b778e755ec5a6
f297d31fc9a5d7a7f2e38cee9b64c00d47a3c38219498a851e1d6002327cc7d1
972ad14c9d140557e809569336abbe18795853a9686d02a970beba920b0133e5
Domains
forvd14sr.top
fivevd5ht.top
thirtvd13pt.top
sevtv17pt.top
tventyv20sb.top
elevenvd11ht.top
tventyvd20sr.top
tventyvd20ht.top
fiftvd15ht.top
thirtvd13sr.top
sevtvd17ht.top
thizx13vt.top
fivevd5sr.top
sevtv17pn.top
twelvevd12sr.top
sivd6sr.top
thirtv13pn.top
fivev5pn.top
siv6pn.top
twexc12ht.top
URLs
http://vbthre3vs.top/zip.php
http://vseven7sr.top/gate.php;
http://fygbib44.top/gate.php;
http://sginiv12.top/gate.php;
http://sgizfn14.top/gate.php;
http://wuqvas12.top/gate.php;
http://vfive5pn.top/gate.php;
http://vfive5sr.top/gate.php;
http://cfive5vt.top/gate.php;
http://xfive5vs.top/gate.php;
http://xfive5sr.top/gate.php;
http://zfive5vt.top/gate.php;
http://pfive5sr.top/gate.php;
http://psix6sb.top/gate.php;
http://psix6vt.top/gate.php/;
http://xfive5pn.top/gate.php;
http://zfive5vs.top/gate.php;
http://zfive5sr.top/gate.php;
http://pfive5pt.top/gate.php;
http://pfive5vt.top/gate.php/;
Last Seen at

Recent blog posts

post image
ANY.RUN Now Integrates with Splunk!
watchers 312
comments 0
post image
How to Analyze Malware in ANY.RUN Sandbox: Er...
watchers 357
comments 0
post image
Security Training Lab: Educational Program fo...
watchers 1157
comments 0

What is CryptBot malware

CryptBot, initially detected in 2019, is an information stealer designed to compromise Windows operating systems.

Its primary purpose is to exfiltrate confidential data from infected machines, such us:

  • browser credentials
  • cryptocurrency wallet details
  • browser cookies
  • credit card data
  • and system screenshots

The primary distribution channels for CryptBot involve spearphishing emails and illicit software cracks.

CryptoBot is a relatively modern malware. However, it’s authors are constantly evolving the threat, making it harder to detect. Around February 2022 researchers began noticing that threat actors simplified CryptBot’s functionality, making it lighter, leaner, and less likely to be detected.

This saw them remove features such as the anti-sandbox evasion, redundant second C2 connection, second exfiltration folder, screenshot function, and the option to collect data on TXT files on the desktop.

At the same time, post 2022 samples have gained targeted additions and improvements that make them more potent. Previously, the malware could only exfiltrate data from Chrome versions between 81 and 95. Now, CryptBot searches all file paths and exfiltrates user data, regardless of the Chrome version in use. This improvement allows CryptBot to be effective against a wider range of targets.

CryptBot infection method

Initiation of the CryptBot attack sequence typically occurs when an unsuspecting user visits a compromised webpage and is lured into downloading what appears to be a legitimate file, such as an SFX file posing as software like Adobe Photoshop. Once the user downloads the file, a malicious SFX file is placed on their computer. When executed, a folder is created in the user's %Temp% directory, containing several files that enable the subsequent stage of the attack.

The folder might contain an authentic Windows DLL, a BAT script, a concealed AutoIT script, and an AutoIT v3 compiler for executables. Some files might be disguised as image, audio, or video files to hide their actual purpose. The specific file extensions used can vary across different CryptBot versions.

The AutoIT interpreter tool, which is frequently exploited by numerous malware families, plays a role in the attack process. The BAT script examines the victim's system for certain antivirus products and uses a "sleep" function to avoid detection if any are found. It is also in charge of decrypting the highly obfuscated AutoIT script and transferring it to the virtual memory area for execution.

In the end, the AutoIT compiler for executables runs the harmful script, initiating an AutoIT process and loading the CryptBot binary into the system's memory.

How to get more information from CryptBot malware

At ANY.RUN, you can securely execute CryptBot and conduct dynamic analysis within a completely interactive cloud-based sandbox environment. Our platform automatically gathers and presents rich execution data in easy-to-read formats.

CryptBot malware configuration extracted by ANY.RUN Figure 1: CryptBot’s configuration automatically extracted by ANY.RUN

You can collect more info about the analyzed sample by looking at extracted malware configuration. A PCAP file for later analysis is also available for download.

CryptBot infostealer execution process

Upon initiating the initial payload, the execution flow of CryptBot can be variable. Cryptbot might sometimes employ the "compile after delivery" technique for defense evasion or release and execute a second file.

Then, the malware gathers data about the infected system, the software installed, and pilfers credentials. For data exfiltration, the stealer often establishes a connection with the C2 domain, with the ** .top** extension. It's noteworthy that it consistently sends requests to a page named gate.php. After completing these actions, the malware may implement a file deletion technique, deleting itself.

Read a detailed analysis of CryptBot in our blog.

Use ANY.RUN free for 14 days

Try the full power of interactive analysis

Start your free trial

Distribution of CryptBot

In addition to utilizing phishing and spearphishing techniques with infected documents, starting around February 2022, CryptBot has expanded its distribution methods by leveraging cracked software lures to target potential victims.

The strategy involves creating websites that masquerade as providers of software cracks, key generators, pirated games, or other utilities. Then, search engine optimization (SEO) techniques are used to rank the malware distribution sites at the top of Google search results.

The malicious websites undergo frequent updates, employing various lures to attract users. Visitors are taken through a series of redirections before reaching the delivery page, which may be hosted on a compromised legitimate site for SEO poisoning attacks.

Wrapping up

CryptBot's primary targets are individuals searching for software cracks, warez, and other methods of bypassing copyright protection. To avoid infection by CryptBot and other similar malware, users should refrain from downloading such tools.

By staying informed about CryptBot's distribution methods and recent changes, malware analysts and security researchers can better understand this threat and develop effective countermeasures.

Speed up your workflow by analyzing CryptBot in ANY.RUN. Create an account using your business email and try our interactive cloud sandbox for free.

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More