# Cryptbot Stealer - Update on Rules

**URL:** <https://community.emergingthreats.net/t/cryptbot-stealer-update-on-rules/790>\
**Category:** Rule Signatures\
**Created:** [July 21, 2023, 6:17pm UTC](https://community.emergingthreats.net/t/cryptbot-stealer-update-on-rules/790 "2023-07-21T18:17:40Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![g0njxa](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/g0njxa/32/364_2.png) [@g0njxa](https://community.emergingthreats.net/u/g0njxa)\
**Post date:** [July 21, 2023, 6:17pm UTC](https://community.emergingthreats.net/t/cryptbot-stealer-update-on-rules/790/1 "2023-07-21T18:17:40Z")

</div>

Cryptbot Stealer has been switching its behavior in the past weeks from uploading logs to C2 on /gate.php to /zip.php. Maybe there are more changes.  
I believe this change has been completed and theres no rule detection for Cryptbot as for now, so old rules must need to be updated.

OLD DETONATION  
([Analysis https://kickasscracks.com Malicious activity - Interactive analysis ANY.RUN](https://app.any.run/tasks/1acacd8b-9ddd-4464-9a32-f190d4660237/))

Rules related to cryptbot fired

- ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M1
- ET MALWARE Win32/Cryptbot V2 Data Exfiltration Attempt
- ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M2

NEW DETONATION  
([Analysis https://abbaspc.net Malicious activity - Interactive analysis ANY.RUN](https://app.any.run/tasks/8e3e870c-04a7-41eb-b52d-3a023185a395))

No rules fired, 0 detection on Cryptbot.

Thanks in advance.

---

_[View the full topic](https://community.emergingthreats.net/t/cryptbot-stealer-update-on-rules/790)._