Extracted

• • Target

    6ad985ac636b93d6c040972403b0de2f643614483a4157d897d2ca310917fd77.exe

  • Size

    1.7MB

  • MD5

    17abc9d745f45caf5d09d735e9545148

  • SHA1

    2deba4d16169f6a34c8f04113659be75bf4c0541

  • SHA256

    6ad985ac636b93d6c040972403b0de2f643614483a4157d897d2ca310917fd77

  • SHA512

    970d73517f9ec7cc2b14452354706532bf9da9c8e510760747bbbfb14e731ae2b38370e4a244ec14425a5141929e09ffaa002dd1d11a198feb76ee7e2110d8c5

  • SSDEEP

    49152:EmCk8AtsXcyxYxlrrCDEUinZuW4VvexQ8r/8TJbb4Ug:cy6XcFxrVUiwWTrktbbf

  Score

  10^/10

  stealcnorddiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2