Extracted

• • Target

    49b3b273bcde3ffa77230bca6036ddd1.exe

  • Size

    2.8MB

  • MD5

    49b3b273bcde3ffa77230bca6036ddd1

  • SHA1

    e25fdf251f5ac4ffad2836ddcfbbd9efb5a1adba

  • SHA256

    4edfbba77374d0a3d2a422b91fe68b169b714e18f0574f8a2480db5ef60133af

  • SHA512

    f47eedfa329214a35f79da74334937c849071e8843ce551a63eab391dc0982424df94e2d881b1c7e5cba70b65c1aa8bc67a8278ce23e95c716654b84dd3cd3cb

  • SSDEEP

    49152:7OJGLUpIRkdAI0B4VQZ3vZdhYwb8ixoQsoyx8Unug+QPZ7/g5PMYD3lE+TjhARFF:7SGbGdAQV4R0wizugbdgLD3DhARFwm

  Score

  10^/10

  blustealercollectionevasionstealerthemidatrojan

  • BluStealer

    A Modular information stealer written in Visual Basic.

    stealerblustealer

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses Microsoft Outlook profiles

    collection

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2