CRYPTBOT
CryptBot is an information-stealing malware family used to harvest browser credentials, cookies, session tokens, financial data, social media accounts, and cryptocurrency wallet data. Multiple sources in the content explicitly describe it as an infostealer, and one report notes later-stage malware assessed as CryptBot searched for browser cookies, passwords, and cryptocurrency wallet files, captured a screenshot, and packaged stolen data into a ZIP archive for upload. Mandiant reported victim workstations infected with CRYPTBOT shortly before stolen Microsoft 365 session tokens were generated, and assessed with moderate confidence that a Russian espionage actor linked to UNC2452 / Nobelium / APT29 obtained session tokens from operators of the CRYPTBOT infostealer.
Observed delivery methods in the content include HijackLoader / RUGMI / IDAT Loader, Emmenhtal, fake CAPTCHA or “paste-and-run” / ClickFix social-engineering chains using obfuscated PowerShell and mshta.exe, SEO-poisoned cracked-software sites, password-protected ZIP-based droppers, malware delivery via CDN cache, and DLL side-loading campaigns. Red Canary observed HijackLoader leading to CryptBot in ClickFix-style activity. Sophos described cracked-software lures and droppers where Windows Defender sometimes raised Conti alerts, but assessed CryptBot as the primary payload. Trellix reported DLL side-loading campaigns abusing trusted signed binaries, including a GitKraken ahost.exe / c-ares-linked chain, to distribute CryptBot alongside other commodity malware. Cisco Talos reported CoralRaider distributing CryptBot, LummaC2, and Rhadamanthys globally, including to entities in Germany and Poland.
The content also shows CryptBot adapting to Chromium cookie protections. Samples were observed spawning Chrome with --remote-debugging-port=9222 and --profile-directory="Default" to recover cookies from Chromium-based browsers after application-bound encryption changes. Unlike some other stealers, CryptBot was noted as not using --headless or off-screen window-position flags in the command line, instead hiding the spawned Chrome window via CreateProcess flags.
Associated actors and ecosystems mentioned in the content are primarily financially motivated cybercrime operators and malware-as-a-service distribution chains, though stolen data from CryptBot infections has also been leveraged by higher-end intrusion actors. Targeting in the content is broad and opportunistic, with global distribution noted; sector-specific DLL side-loading campaigns distributing CryptBot targeted oil and gas, import/export, and business functions such as finance, procurement, supply chain, and administration. High-confidence indicators directly mentioned include the Chrome remote-debugging behavior using port 9222 and profile-directory Default, and infrastructure/delivery associations such as HijackLoader, Emmenhtal, ClickFix/mshta.exe chains, DLL side-loading, and CoralRaider distribution.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Mandiant analyzed the workstations belonging to the end user and discovered that some systems had been infected with CRYPTBOT, an info-stealer malware, shortly before the stolen session token was generated.
Techniques & procedures
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Execution
5 techniques
Execution
Next, it copies a third file ( Fra.pptx ) to a file with a single letter name ( H here). That file contains an obfuscated script and then passes that as a runtime parameter to the just-extracted AutoIT script.
We’ve been observing an initial access technique that tricks users into copying, pasting, and executing malicious PowerShell code... users are presented with the typical Verify You Are Human prompt... Clicking the button silently copies an obfuscated PowerShell command to the clipboard and presents the user with “Verification Steps” instructing them to: Press Windows Button + R... Press CTRL + V... Press Enter. | One technique we’ve recently seen lead to LummaC2 involves tricking users into copying a PowerShell script from a pop-up message, pasting it into the Windows Run dialogue box, and executing malicious PowerShell code.
The dropper launches one of them with cmd.exe, essentially using it as a batch script to create the second-stage malware.
Stealth
5 techniques
Stealth
In most of the samples we studied, these files were labeled as PowerPoint (.pptx) files. Others had extensions that associate them with graphics files, Word template files, and other (normally) benign filetypes. But they were not any of these.
An encoded PowerShell command then leverages Microsoft HTML Application Host (mshta.exe) to download and execute a malicious payload from a remote resource... Detection opportunity: mshta.exe utility making external network connections.
The strings in the real second-stage dropper includes a number of anti-analysis checks, looking for virtual machine artifacts, tools used for web traffic analysis, and other sandboxing tools.
Credential Access
2 techniques
Credential Access
Discovery
4 techniques
Discovery
The third stage also gathers up all system information, passwords and cookies from browsers, and other data...
The strings in the real second-stage dropper includes a number of anti-analysis checks, looking for virtual machine artifacts, tools used for web traffic analysis, and other sandboxing tools.
Collection
2 techniques
Collection
IOCs tracked for this family
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stealer malware family explicitly listed as distributed by RUGMI/IDAT Loader.
In another campaign identified by Trellix, DLL sideloading was used to distribute a wide assortment of malware, such as Agent Tesla, CryptBot, Formbook, Lumma Stealer, Vidar Stealer, Remcos RAT, Quasar RAT, DCRat, and XWorm.
"...DLL sideloading was used to distribute a wide assortment of malware, such as Agent Tesla, CryptBot, Formbook, Lumma Stealer, Vidar Stealer, Remcos RAT, Quasar RAT, DCRat, and XWorm."
Stealer payload delivered via DLL sideloading in this campaign.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.