Dynamic Forensic Analysis of CryptBot Malware

CryptBot, an infostealer malware first identified in 2019, poses a serious threat by stealing sensitive data, including login credentials and cryptocurrency wallet details, and transmitting them to command-and-control servers. It spreads through phishing emails, malicious ads, and pirated software, using advanced evasion techniques to remain undetected. This study employs dynamic malware analysis to observe CryptBot’s real-time behavior, including its data exfiltration methods, persistence mechanisms, and evasion strategies. Key findings reveal tactics such as subprocess creation, process renaming, and temporary file usage to facilitate data theft. To mitigate such threats, a multi-layered security approach is essential, combining dynamic, static, and hybrid analysis methods with security measures like intrusion detection, encryption, and multi-factor authentication. Additionally, user education on phishing and software piracy is crucial in preventing infections. This research enhances understanding of CryptBot’s operations and proposes detection and mitigation strategies. Future work includes developing advanced sandbox environments and integrating machine learning to improve threat detection and response.