Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    a5ac4af7cce548bcdefe3ea60b226f3c

  • SHA1

    b1571f043347987ffb4e90806fae84165a664399

  • SHA256

    1cb080c3d69281ff2af28a3b9f448ba493bba28b1c2fde989d5fe91eef4689ea

  • SHA512

    58b0e239196b961a36649ab9684d917ca7a88c08a0817aece90c2ec6417ddc637ad6092b4dcb5121acfc05757f84eabf18e528fd225148db3f0d4dcaabc39ae5

  • SSDEEP

    24576:7HQxE8arKdOhxJ3PHjPEb6UKc8sfjX3BqljMJX/ySEx8EFM5fqCeX:LQxzdcVZLsfjX3slAzM8QM5CC

  Score

  10^/10

  stealcsavediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2