Extracted

• • Target

    7af1ac95d468a1b0d9dfb2dbe0dba8b3aca9a09e2620a0ec35dc087f829f9401.exe

  • Size

    1.7MB

  • MD5

    1777e41c01138cfcd1b8e4b6082ae3b1

  • SHA1

    bf83c19106c0226d8e3e08fbbd5633ce96472bf0

  • SHA256

    7af1ac95d468a1b0d9dfb2dbe0dba8b3aca9a09e2620a0ec35dc087f829f9401

  • SHA512

    e44f8d2b9c5f33b48c64107b9a1c8fd0ac77bf88b465e6fcdbcc2b1b3253f71922b350048e55b6d97e938892084b0d7cc098cdd208ee1f15b9434426449fa88b

  • SSDEEP

    49152:V7W9uuFKbA8/VUtFlVMFCZVjyizEDOztVefhGMxSSY:TiKbd9UBVMy2izYO8

  Score

  10^/10

  stealclevadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2