Extracted

• • Target
    file.exe
  • Size 8.6MB
  • SHA256 9a6872a650bffa7b42a4fb73ebb8d81dc8a60aeeccc71b23e0449612bd88e51c
  • MD5 8336d73a7b3ddf572de7e044ff54830d
  • SHA1 e1597ba90a309932b19108dff49c0c228f6ac63d
  • SHA512 d886563a56ee8eb221a3b491cfed41bfb8daae9182efe2a9de441c1614938d8f90152f9fb24ca6fe3d755199ff409b42c3e4d8ef43b842f0d5009b893aea2c0f
  • SSDEEP 196608:90L8R/johVgscDmfTgnvqZ1yCUhNDRBewm886hZ2:90Lg/Qwmf0vG6B6mc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tr1pernndefense_evasiondiscoverystealcspywarestealerthemidatrojan

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1behavioral2