Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    2b6a17cf5d76f7664806991d7619e998

  • SHA1

    b32948270dcb41941e0f98122f9c9d48a36c199c

  • SHA256

    beb033b6b81e60ed419ba19985a2c7d1ffb6a4bcadf151e4686404079e0c7747

  • SHA512

    ce8038b52f4ac00fc86b7f26627f8ce1d5d76e59c81003a0362b3a491ee2a7735a4eedda7cc4541ee1ae6e3b13e6159cd16b3d25c200fec3daaf4f6fb44d19d7

  • SSDEEP

    24576:cLdBGtGG1W4UNJXbn4hHdXkoPPdYTngYY/Liz54HHX+kfy0gHOFTXVPZvC6GOgGt:iGjUL2yA2TzURfLgHOFTXBZ6ygG30n

  Score

  10^/10

  stealcdomadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2