Extracted

• • Target

    stealer_protect-Copy.exe

  • Size

    9.1MB

  • MD5

    cb86dd3b875f9cbd61325b45e50373a0

  • SHA1

    24b293baf601633d98ac46794ce35675011df210

  • SHA256

    14e0330250b54a0f15e5db48a53b0bf6517bed4fec8209eb5dc1df49ba9e5b8b

  • SHA512

    5019feeb950eb8a8fad4cdb161a43724b2600a5da12b26e1feb1bc4419b6f977b2016b106efcdb99271ff0b0c905a03b5a8c70df7283ec2449186c741b869011

  • SSDEEP

    196608:7G0ytxxQdi7nJf77gov4fplpRQSk5ZMGQfPXeLA52ANexrNceFcLQdc6E:7GZCWnN4OSWOvfPFCFF4Q

  Score

  10^/10

  skuldstealervmprotectpersistence

  • Skuld family

    skuld

  • Skuld stealer

    An info stealer written in Go lang.

    stealerskuld

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2