Extracted

• • Target

    6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1.exe

  • Size

    1.8MB

  • MD5

    36cb6ec78aa8cd0a33dfb06d03a0a389

  • SHA1

    42cc15ec861309afa84e627e563d251da1afc4c4

  • SHA256

    6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1

  • SHA512

    f0e7be775cec5fc9710de71652fe48a3c70103e75d30868465cc47c73740fb6b163c5943e8cec4ff091e17c5d7ff7b5d682d245a58d02894d87e4fb1dd7f305b

  • SSDEEP

    49152:m8ZF3q43USo4eI5+louuCkIbceV6+PDFl83sUiitG75txsNa:/q4EFpuCkQxZbFS8Xit++Na

  Score

  10^/10

  stealcsavediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2