Extracted

• • Target

    4ae707f447635ea5b4baf2db00265ae1fee0ad0b99fcd535424d6f1a2e0a1894.exe

  • Size

    2.7MB

  • MD5

    d1300cf7e1b922d4ba3d3610499a1e4e

  • SHA1

    d3fa98db07d835d455e081b33e2853246e7d7d17

  • SHA256

    4ae707f447635ea5b4baf2db00265ae1fee0ad0b99fcd535424d6f1a2e0a1894

  • SHA512

    6c71542f70170cb8a1c16bcbcaac0123afb75cce5fcb93dfa728593ad8160ec839ea5da9443ee75a08d01b067de428c8063a41c71ba8beaa0cde2f6d22f25fae

  • SSDEEP

    24576:DiOGLCyzsVtR5+4JzJBvVtUtk0J3W7OxNiIaAfhsuwhzjC8XK4yil5UuQH/peQIE:+C3VdJjV+G0JbilZTpyupgpX8Gbfd

  Score

  10^/10

  stealcravediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2