Extracted

• • Target

    56b6e17006b25ce5586d1441a2db7cc8.exe

  • Size

    2.8MB

  • MD5

    56b6e17006b25ce5586d1441a2db7cc8

  • SHA1

    65163f385f5180a1dee189044d1df296af61ce70

  • SHA256

    31f20e519939289560661eb6fe04be9f73bbf17c3c22a9b8087c59e60bae8873

  • SHA512

    171fb597dcffe783024452460fad8e37af7fd87ab003674917085a468fddba9e1a9436d2a8b318420602705d44061153a8f18c79380a9df5f360f150af1d77f5

  Score

  10^/10

  blustealercollectionevasionstealerthemidatrojan

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses Microsoft Outlook profiles

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2