Extracted

• • Target
    file.exe
  • Size 2.3MB
  • SHA256 23f529a02ef4ecfefc10d5610520765c0c85fc7b385768ffc7b02a976718c8d2
  • MD5 e932c706b325542183a82a00b253bcc8
  • SHA1 03f84e2372b46ca9e58528bbe11dd808ab900803
  • SHA512 98d9398ba6d30d42d6e5df2eaafb52affa2101e17329abac82ac96504532b70bbe612c981fb7c1091261d1347af0320355ba4ba719373c11db71a977cb151ed1
  • SSDEEP 49152:R87yfE/gnm8qm9slHPmSeVd69Nw6HtNeF4+3dxxYsQpMb/q0wZiy:wv00e4ENxDX/xwZi
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tr1pernndefense_evasiondiscoverystealcspywarestealerthemidatrojan

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan
  behavioral1behavioral2