Extracted

• • Target

    S0FTWARE.exe

  • Size

    782.2MB

  • MD5

    bd166012acef52ffce31789bafff6588

  • SHA1

    e2968f7f62266d05b4628c6351a676d5d0e8e22f

  • SHA256

    3aaa6bb7d6b82cc554bb14493af5afe184125089a9aa1c3759b82fbb7241c87a

  • SHA512

    d8786f5ebc199c667924e697bce5b4185492161af351511145d91c47c06df56b1b50b6520f3b9ce6bc37a1bb1b9b9ba6fbe18f1f3f881d7dbe8cb28990e2c3c3

  • SSDEEP

    98304:qD8PPKKvxZbk8aPZXMc9cBc9cBc9cBc9cBc9cBc9cBc9cBc9cBc9cBc9cBc9cBck:m8PJk8ae

  Score

  10^/10

  stealcvidar58b6d099477b3b8d6d299990bbc1d5a6discoveryevasionstealerthemidatrojan

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Vidar family

    vidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2