Extracted

• • Target
    ZCYxSCA9cbn8voXjBSQrPnD8.exe
  • Size 2.5MB
  • SHA256 fb110b1db7c02725d6cb0953cf153a2b5e158d358db136aece90ac06d79cb07d
  • MD5 23b163180bc13aa5f430c2cf0413da12
  • SHA1 c03af31d714b26d2bf254dd986208f20b37885dd
  • SHA512 598fdd55f492a164c7b669e777d73a0e17b5db0e34d484cae591743699d524b794a6794db9cc0616ccc2412cc9557fa12d8c3780dbf62b8635db76698bbbd77b
  • SSDEEP 49152:1XaijDDioKqQCOlNBSVPtiCdCLBHkJ2MHjFVWquPgmNW5klRBIdltPAFEP:nDHKRstiCdGHHIjFVWhjNW5uQo6P
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcdefense_evasiondiscoverystealerthemidatrojan

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2