SYMBOLCOMMON_NAMEaka. SYNONYMS
win.cryptbot (Back to overview)

CryptBot


A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.

References
2023-04-26United States District Court (Southern District of New York)Google
@techreport{google:20230426:cryptbot:ea44d7c, author = {Google}, title = {{CryptBot complaint against Zubair Saeed, Raheel Arshad and Mohammad Rasheed Siddiqui}}, date = {2023-04-26}, institution = {United States District Court (Southern District of New York)}, url = {https://regmedia.co.uk/2023/04/28/handout_google_cryptbot_complaint.pdf}, language = {English}, urldate = {2023-05-02} } CryptBot complaint against Zubair Saeed, Raheel Arshad and Mohammad Rasheed Siddiqui
CryptBot
2023-04-13GoogleMike Trinh, Pierre-Marc Bureau, Google Threat Analysis Group
@online{trinh:20230413:continuing:c9d837c, author = {Mike Trinh and Pierre-Marc Bureau and Google Threat Analysis Group}, title = {{Continuing our work to hold cybercriminal ecosystems accountable}}, date = {2023-04-13}, organization = {Google}, url = {https://blog.google/technology/safety-security/continuing-our-work-to-hold-cybercriminal-ecosystems-accountable/}, language = {English}, urldate = {2023-05-02} } Continuing our work to hold cybercriminal ecosystems accountable
CryptBot
2023-03-16OALabsSergei Frankoff
@online{frankoff:20230316:cryptbot:9cd940b, author = {Sergei Frankoff}, title = {{CryptBot}}, date = {2023-03-16}, organization = {OALabs}, url = {https://research.openanalysis.net/cryptbot/botnet/yara/config/2023/03/16/cryptbot.html}, language = {English}, urldate = {2023-05-02} } CryptBot
CryptBot
2023-01-26ANY.RUNANY.RUN
@online{anyrun:20230126:cryptbot:fa17489, author = {ANY.RUN}, title = {{CryptBot Infostealer: Malware Analysis}}, date = {2023-01-26}, organization = {ANY.RUN}, url = {https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/}, language = {English}, urldate = {2023-01-27} } CryptBot Infostealer: Malware Analysis
CryptBot
2022-08-08Medium CSIS TechblogBenoît Ancel
@online{ancel:20220808:inside:67ef9a0, author = {Benoît Ancel}, title = {{An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure}}, date = {2022-08-08}, organization = {Medium CSIS Techblog}, url = {https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145}, language = {English}, urldate = {2022-08-28} } An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure
Riltok magecart Anubis Azorult BetaBot Buer CoalaBot CryptBot DiamondFox DreamBot GCleaner ISFB Loki Password Stealer (PWS) MedusaLocker MeguminTrojan Nemty PsiX RedLine Stealer SmokeLoader STOP TinyNuke Vidar Zloader
2022-06-28AhnLabASEC
@online{asec:20220628:new:df3f9bf, author = {ASEC}, title = {{New Info-stealer Disguised as Crack Being Distributed}}, date = {2022-06-28}, organization = {AhnLab}, url = {https://asec.ahnlab.com/en/35981/}, language = {English}, urldate = {2022-06-30} } New Info-stealer Disguised as Crack Being Distributed
ClipBanker CryptBot Raccoon RedLine Stealer
2022-06-02MandiantMandiant
@online{mandiant:20220602:trending:0bcdbc4, author = {Mandiant}, title = {{TRENDING EVIL Q2 2022}}, date = {2022-06-02}, organization = {Mandiant}, url = {https://experience.mandiant.com/trending-evil-2/p/1}, language = {English}, urldate = {2022-06-07} } TRENDING EVIL Q2 2022
CloudEyE Cobalt Strike CryptBot Emotet IsaacWiper QakBot
2022-03-16FR3D.HKFred HK
@online{hk:20220316:cryptbot:9903e3f, author = {Fred HK}, title = {{CryptBot - Too good to be true}}, date = {2022-03-16}, organization = {FR3D.HK}, url = {https://fr3d.hk/blog/cryptbot-too-good-to-be-true}, language = {English}, urldate = {2022-04-15} } CryptBot - Too good to be true
CryptBot
2022-03-10BlackberryThe BlackBerry Research & Intelligence Team
@online{team:20220310:threat:64ccfb2, author = {The BlackBerry Research & Intelligence Team}, title = {{Threat Thursday: CryptBot Infostealer Masquerades as Cracked Software}}, date = {2022-03-10}, organization = {Blackberry}, url = {https://blogs.blackberry.com/en/2022/03/threat-thursday-cryptbot-infostealer}, language = {English}, urldate = {2023-05-02} } Threat Thursday: CryptBot Infostealer Masquerades as Cracked Software
CryptBot
2022-02-21Bleeping ComputerBill Toulas
@online{toulas:20220221:revamped:7315878, author = {Bill Toulas}, title = {{Revamped CryptBot malware spread by pirated software sites}}, date = {2022-02-21}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/revamped-cryptbot-malware-spread-by-pirated-software-sites/}, language = {English}, urldate = {2022-02-26} } Revamped CryptBot malware spread by pirated software sites
CryptBot
2022-02-21AhnLabAhnLab ASEC Analysis Team
@online{team:20220221:modified:6fd1e56, author = {AhnLab ASEC Analysis Team}, title = {{Modified CryptBot Infostealer Being Distributed}}, date = {2022-02-21}, organization = {AhnLab}, url = {https://asec.ahnlab.com/en/31802/}, language = {English}, urldate = {2023-05-02} } Modified CryptBot Infostealer Being Distributed
CryptBot
2022-02-18AhnLabASEC Analysis Team
@online{team:20220218:pseudomanuscrypt:4aa75d9, author = {ASEC Analysis Team}, title = {{PseudoManuscrypt Being Distributed in the Same Method as Cryptbot}}, date = {2022-02-18}, organization = {AhnLab}, url = {https://asec.ahnlab.com/en/31683/}, language = {English}, urldate = {2022-02-19} } PseudoManuscrypt Being Distributed in the Same Method as Cryptbot
CryptBot PseudoManuscrypt
2021-12-06MandiantLuke Jenkins, Sarah Hawley, Parnian Najafi, Doug Bienstock, Luis Rocha, Marius Fodoreanu, Mitchell Clarke, Manfred Erjak, Josh Madeley, Ashraf Abdalhalim, Juraj Sucik, Wojciech Ledzion, Gabriella Roncone, Jonathan Leathery, Ben Read, Microsoft Threat Intelligence Center (MSTIC), Microsoft Detection and Response Team (DART)
@online{jenkins:20211206:suspected:d9da4ec, author = {Luke Jenkins and Sarah Hawley and Parnian Najafi and Doug Bienstock and Luis Rocha and Marius Fodoreanu and Mitchell Clarke and Manfred Erjak and Josh Madeley and Ashraf Abdalhalim and Juraj Sucik and Wojciech Ledzion and Gabriella Roncone and Jonathan Leathery and Ben Read and Microsoft Threat Intelligence Center (MSTIC) and Microsoft Detection and Response Team (DART)}, title = {{Suspected Russian Activity Targeting Government and Business Entities Around the Globe (UNC2452)}}, date = {2021-12-06}, organization = {Mandiant}, url = {https://www.mandiant.com/resources/russian-targeting-gov-business}, language = {English}, urldate = {2021-12-07} } Suspected Russian Activity Targeting Government and Business Entities Around the Globe (UNC2452)
Cobalt Strike CryptBot
2021-12-04BleepingComputerBill Toulas
@online{toulas:20211204:malicious:b9cff07, author = {Bill Toulas}, title = {{Malicious KMSPico installers steal your cryptocurrency wallets}}, date = {2021-12-04}, organization = {BleepingComputer}, url = {https://www.bleepingcomputer.com/news/security/malicious-kmspico-installers-steal-your-cryptocurrency-wallets/}, language = {English}, urldate = {2022-04-07} } Malicious KMSPico installers steal your cryptocurrency wallets
CryptBot
2021-12-02Red CanaryTony Lambert
@techreport{lambert:20211202:kmspico:4e3afa7, author = {Tony Lambert}, title = {{KMSPico and Cryptbot: A spicy combo}}, date = {2021-12-02}, institution = {Red Canary}, url = {https://redcanary.com/wp-content/uploads/2021/12/KMSPico-V5.pdf}, language = {English}, urldate = {2021-12-07} } KMSPico and Cryptbot: A spicy combo
CryptBot
2021-08-09AhnLabASEC Analysis Team
@online{team:20210809:cryptbot:9b8a111, author = {ASEC Analysis Team}, title = {{CryptBot Infostealer Constantly Changing and Being Distributed}}, date = {2021-08-09}, organization = {AhnLab}, url = {https://asec.ahnlab.com/en/26052/}, language = {English}, urldate = {2022-04-15} } CryptBot Infostealer Constantly Changing and Being Distributed
CryptBot
2021-06-28AhnLabAhnLab
@online{ahnlab:20210628:cryptbot:6d593f3, author = {AhnLab}, title = {{CryptBot Info-stealer Malware Being Distributed in Different Forms}}, date = {2021-06-28}, organization = {AhnLab}, url = {https://asec.ahnlab.com/en/24423/}, language = {English}, urldate = {2022-04-07} } CryptBot Info-stealer Malware Being Distributed in Different Forms
CryptBot
2020-02-06GdataKarsten Hahn
@online{hahn:20200206:40000:3a0d792, author = {Karsten Hahn}, title = {{40,000 CryptBot Downloads per Day: Bitbucket Abused as Malware Slinger}}, date = {2020-02-06}, organization = {Gdata}, url = {https://www.gdatasoftware.com/blog/2020/02/35802-bitbucket-abused-as-malware-slinger}, language = {English}, urldate = {2020-04-02} } 40,000 CryptBot Downloads per Day: Bitbucket Abused as Malware Slinger
CryptBot
Yara Rules
[TLP:WHITE] win_cryptbot_auto (20230808 | Detects win.cryptbot.)
rule win_cryptbot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.cryptbot."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 33c0 85ed 0f94c0 8be8 }
            // n = 4, score = 700
            //   33c0                 | xor                 eax, eax
            //   85ed                 | test                ebp, ebp
            //   0f94c0               | sete                al
            //   8be8                 | mov                 ebp, eax

        $sequence_1 = { 33c0 eb0a b917d90000 e8???????? }
            // n = 4, score = 600
            //   33c0                 | xor                 eax, eax
            //   eb0a                 | jmp                 0xc
            //   b917d90000           | mov                 ecx, 0xd917
            //   e8????????           |                     

        $sequence_2 = { e9???????? b949dc0000 e9???????? b944dc0000 e9???????? b964dc0000 }
            // n = 6, score = 600
            //   e9????????           |                     
            //   b949dc0000           | mov                 ecx, 0xdc49
            //   e9????????           |                     
            //   b944dc0000           | mov                 ecx, 0xdc44
            //   e9????????           |                     
            //   b964dc0000           | mov                 ecx, 0xdc64

        $sequence_3 = { e8???????? 85c0 750c b961030200 e8???????? }
            // n = 5, score = 600
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   750c                 | jne                 0xe
            //   b961030200           | mov                 ecx, 0x20361
            //   e8????????           |                     

        $sequence_4 = { 0f9cc0 eb02 32c0 84c0 }
            // n = 4, score = 600
            //   0f9cc0               | setl                al
            //   eb02                 | jmp                 4
            //   32c0                 | xor                 al, al
            //   84c0                 | test                al, al

        $sequence_5 = { eb0c b99fed0000 e8???????? 8907 }
            // n = 4, score = 600
            //   eb0c                 | jmp                 0xe
            //   b99fed0000           | mov                 ecx, 0xed9f
            //   e8????????           |                     
            //   8907                 | mov                 dword ptr [edi], eax

        $sequence_6 = { e8???????? 85c0 750e b9ca070200 e8???????? 8bc8 }
            // n = 6, score = 600
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   750e                 | jne                 0x10
            //   b9ca070200           | mov                 ecx, 0x207ca
            //   e8????????           |                     
            //   8bc8                 | mov                 ecx, eax

        $sequence_7 = { e8???????? 85c0 750f b955960100 e8???????? e9???????? }
            // n = 6, score = 600
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   750f                 | jne                 0x11
            //   b955960100           | mov                 ecx, 0x19655
            //   e8????????           |                     
            //   e9????????           |                     

        $sequence_8 = { 744e 0fb74802 83e103 3bcb }
            // n = 4, score = 400
            //   744e                 | je                  0x50
            //   0fb74802             | movzx               ecx, word ptr [eax + 2]
            //   83e103               | and                 ecx, 3
            //   3bcb                 | cmp                 ecx, ebx

        $sequence_9 = { 750b 8bce e8???????? 8b4c2428 }
            // n = 4, score = 400
            //   750b                 | jne                 0xd
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   8b4c2428             | mov                 ecx, dword ptr [esp + 0x28]

        $sequence_10 = { 7508 85f6 7404 c6464101 5e c3 }
            // n = 6, score = 400
            //   7508                 | jne                 0xa
            //   85f6                 | test                esi, esi
            //   7404                 | je                  6
            //   c6464101             | mov                 byte ptr [esi + 0x41], 1
            //   5e                   | pop                 esi
            //   c3                   | ret                 

        $sequence_11 = { 7518 8b542414 83c718 8bcd }
            // n = 4, score = 400
            //   7518                 | jne                 0x1a
            //   8b542414             | mov                 edx, dword ptr [esp + 0x14]
            //   83c718               | add                 edi, 0x18
            //   8bcd                 | mov                 ecx, ebp

        $sequence_12 = { 7409 33d2 e8???????? 8bf8 43 }
            // n = 5, score = 400
            //   7409                 | je                  0xb
            //   33d2                 | xor                 edx, edx
            //   e8????????           |                     
            //   8bf8                 | mov                 edi, eax
            //   43                   | inc                 ebx

        $sequence_13 = { 2403 80e110 8ad1 3c02 7509 }
            // n = 5, score = 400
            //   2403                 | and                 al, 3
            //   80e110               | and                 cl, 0x10
            //   8ad1                 | mov                 dl, cl
            //   3c02                 | cmp                 al, 2
            //   7509                 | jne                 0xb

        $sequence_14 = { 751f 8bd5 8bce e8???????? }
            // n = 4, score = 400
            //   751f                 | jne                 0x21
            //   8bd5                 | mov                 edx, ebp
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     

    condition:
        7 of them and filesize < 11116544
}
Download all Yara Rules