Extracted

• • Target

    29c0837a12402c5c105fb2f2d3e31010b244c6ec0c437b3b7a977709f981d481.exe

  • Size

    1.7MB

  • MD5

    32fab6249908f4132bd4112d5d07c8f7

  • SHA1

    6adafe56c06fde0cc3cb31ba02bb32f2a499fe83

  • SHA256

    29c0837a12402c5c105fb2f2d3e31010b244c6ec0c437b3b7a977709f981d481

  • SHA512

    f3e24f8d6c7dba0315a27de7503a0f269618caaceeaefbb3fbba742b8d36854386246de3aa024ee95a474db9d440a5cf77017b38d65b0977007c4c7740c15f33

  • SSDEEP

    24576:elFsHdob8laggbUwdIXDa2cDMfrgx+ZJSzRmNprmzsnZkTdwktav8ZztYyHszbQY:2Fxq7hwwa2Nf8x+KzRarmzLdrEvLQNK

  Score

  10^/10

  stealclevadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2