Extracted

• • Target

    f191cc28ee681ea36c73780f422739493d6e8db494c07534a9ea2a688b02595a.exe

  • Size

    2.9MB

  • MD5

    33e21757c66d40d3dc94d24ded6840a1

  • SHA1

    8500808931bea3a20659e43c9398cfb948db9e6c

  • SHA256

    f191cc28ee681ea36c73780f422739493d6e8db494c07534a9ea2a688b02595a

  • SHA512

    72c49e886cbeee046b5f6a035725ebf58f4dd924047d9fde876c1e2ff84d97d57ebcc061aff55be287d6fc6305a0694ebf1438cf1290b4a511fc5543fe30b168

  • SSDEEP

    49152:UKks3TOJjbiQDqW9q/uoc+uRT9/BJgpi8MVNiq3e/:U83T+jbiQDH9LDN9Api8M7iq3e/

  Score

  10^/10

  stealcdeardiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2