Extracted

• • Target

    99dfe8a4454f28c944e3c749150aecdaa97e19bcc5a9cf644a509b7eb1d4e50f.exe

  • Size

    4.0MB

  • MD5

    919db35f2bf4dad6dd23e16b68dbb205

  • SHA1

    97a493eb8ebcac4fa8f61c357365d443c72e40dc

  • SHA256

    99dfe8a4454f28c944e3c749150aecdaa97e19bcc5a9cf644a509b7eb1d4e50f

  • SHA512

    efa3e69c8c3e6b1af82ae4a6c89412fbcc4d21eaf61349c235810fef4790b5b6f7373c1ca0adb2ca7efcd2ea61635968f9d2237802422cf6046039aab27fa05e

  • SSDEEP

    98304:z8Ho3wEF+ZSxV4CQrRZIfIM8R6nhYufLX6CL2VeUs:z8IqRSxi6dLqi

  Score

  10^/10

  stealcdefaultevasionstealerthemidatrojandiscovery

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Detects executables packed with Themida

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2