MALWARE FAMILY

CryptBot

Internal ID: win.cryptbot

aliases

Last seen:Mar 17, 2026

Intelligence Profile

A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.

Threat Analysis

CryptBot is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/

→https://asec.ahnlab.com/en/24423/

→https://asec.ahnlab.com/en/26052/

→https://asec.ahnlab.com/en/31683/

→https://asec.ahnlab.com/en/31802/

→https://asec.ahnlab.com/en/35981/

→https://blog.google/technology/safety-security/continuing-our-work-to-hold-cybercriminal-ecosystems-accountable/

→https://blogs.blackberry.com/en/2022/03/threat-thursday-cryptbot-infostealer

→https://cloud.google.com/blog/topics/threat-intelligence/peaklight-decoding-stealthy-memory-only-malware/

→https://experience.mandiant.com/trending-evil-2/p/1

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.cryptbot

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search CryptBot