Extracted

• • Target

    adc570c21dfdc38b2b30dfa98cbd8fff624f5a83397e9199189b2182405a9535.exe

  • Size

    1.7MB

  • MD5

    69f6fc7d0c166c0dddd3f539ae64739b

  • SHA1

    5f7561a022e961c7536f701b30c427e0a63031f5

  • SHA256

    adc570c21dfdc38b2b30dfa98cbd8fff624f5a83397e9199189b2182405a9535

  • SHA512

    f1c2f151e26b93013d8327bf79d7cacd6427fa9bed0d6c400c5f8c5a614e484fa74ea2b0c9f9bc4106b5b720214ab304ab61d556665cc45b0d7073569ec05e1c

  • SSDEEP

    49152:D7u2+laiu9YTf+FWtwUYHXZ5l3JtI4JzYYrDfw:G183AwrxTI4hrr

  Score

  10^/10

  stealcnorddiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2