Extracted

• • Target

    ZCYxSCA9cbn8voXjBSQrPnD8.exe

  • Size

    2.5MB

  • MD5

    23b163180bc13aa5f430c2cf0413da12

  • SHA1

    c03af31d714b26d2bf254dd986208f20b37885dd

  • SHA256

    fb110b1db7c02725d6cb0953cf153a2b5e158d358db136aece90ac06d79cb07d

  • SHA512

    598fdd55f492a164c7b669e777d73a0e17b5db0e34d484cae591743699d524b794a6794db9cc0616ccc2412cc9557fa12d8c3780dbf62b8635db76698bbbd77b

  • SSDEEP

    49152:1XaijDDioKqQCOlNBSVPtiCdCLBHkJ2MHjFVWquPgmNW5klRBIdltPAFEP:nDHKRstiCdGHHIjFVWhjNW5uQo6P

  Score

  10^/10

  stealcdefense_evasiondiscoverystealerthemidatrojan

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2