en
CryptBot StealerCrypt BotCryptBot (also known as CryptBot Stealer and Crypt Bot) is an information-stealing malware family. CryptBot targets browser credentials, cryptocurrency wallets, Saved form data, System hardware and locale inventory and Screenshot of the desktop. As of 11/10/2026, CyStack's research records 3 variants distributed through 1 channel, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
CryptBot is a Delphi-built info-stealer first publicly
documented in December 2019. The family is best known for its
_Information.txt victim summary plus sibling files
_AllPasswords_list.txt, _AllCookies_list.txt,
_AllForms_list.txt, _AllWallets_list.txt, and
Screen.png, all written into a per-victim folder under
%TEMP%. Multiple builder versions have been observed (v2.0,
v3.0, v3.1 per public analyses); the field set in the summary
file is stable across versions, with the v3.x line moving the
qualifier on UserName and Data fields from parentheses to
a brackets variant in some rebrand samples.
CryptBot distribution leans on SEO-poisoned cracked-software landing pages and bundled freeware installers. The malware writes the victim summary to disk, packs it with the harvested credential / cookie / wallet files into a ZIP, and POSTs the archive to a hard-coded C2 gate.
1 distinct distribution channel recorded for this malware
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
| Panel name |
|---|
| Distribution channel |
|---|
| Confidence |
|---|
| ot******** | Telegram | High |
The data in this table is for reference only and is compiled by CyStack researchers. To investigate and scope an incident in detail, organizations should use dedicated solutions such as CyStack Threat Intelligence
3 variants recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
3961dc7... | 1 | High |
ab22602... | 1 | High |
cbcdfdb... | 4 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
* Telegram : <value> OS: <value> Keyboard Languages: <value> CPU: <value> RAM: <value> GPU: <value> Display Resolution: <value> Installed software:
