Extracted

• • Target

    d97ea33a0e542b7f0c09660804644a80a364a9dc6bff8d67f56a46a6482ff8f9.exe

  • Size

    1.8MB

  • MD5

    4c39c92c188fe942be50a1b66fbeb79b

  • SHA1

    be3e48dc323266cfa6b05494191e088c642c5a12

  • SHA256

    d97ea33a0e542b7f0c09660804644a80a364a9dc6bff8d67f56a46a6482ff8f9

  • SHA512

    99a5b9606b74d38188af18c7cd874d8544a35808e8b517de3f5319f1911200179bbe599b54a104d606c8180358312d2d8d7530dc3ff97a6e0f5a880061d0bde2

  • SSDEEP

    49152:PV+pT/4WNbIelTL+XtJxVaO9XivvLWM6kTmbWu59iApP:PG/4Ne9L8PVasOvLP6QsW

  Score

  10^/10

  stealcsavediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2