Extracted

• • Target

    file.exe

  • Size

    1.7MB

  • MD5

    53c07d8a0635d22d00ebfce7c37e1bb7

  • SHA1

    2044708140b4ccf866422eb576c64c82a0e2bd9d

  • SHA256

    4b7c4f962efb008258a86ed61d4482ed555a42e635c8ae9d77a5c490cccecefa

  • SHA512

    b11ecf998822cb0c78bde20b5ac336a1a01df9d0ac8a735a790e18a94a0bd77e0a12f05cc5c4595d787ac9c5244977cedc5180d8bffac7f27bf51a9ea6355ffe

  • SSDEEP

    24576:RafT4xd89Da5wA79C8Ojial5gnowdLVsQIDmXh5uKc3Cm5D+bAX3Ai17u/tkh39:4E89W517Ep15gnZLVsQbXPuK69EaDB

  Score

  10^/10

  stealclevadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2