Extracted

• • Target

    27cc6f14645280d84d872a3d4bf0adf3ccaf289bf0014e79c50dee92a048f478.exe

  • Size

    2.8MB

  • MD5

    9add56c0d441bc39094e12a54dfd1310

  • SHA1

    1840122488552192518f57d930a3b6cd905da9ad

  • SHA256

    27cc6f14645280d84d872a3d4bf0adf3ccaf289bf0014e79c50dee92a048f478

  • SHA512

    19c903fd2cf5afc641595e83e2a5b3a4ac98e5238ef94ec8bd8a5225cacfb74dd609ce6ecd8f2f0af1a79792391cb897b2713f46d7433d901cfbea24bcbae673

  • SSDEEP

    49152:Nv6XmEUiBDwT3DIP9WfboVx22uxx7iPWec:NemEUiBkTTIP9ioLuxx7iPWB

  Score

  10^/10

  stealcdeardiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2