Extracted

• • Target

    91d20ed7e7cb5e93f1a7c51ae70ff4f45bd444b9547f0dfad6dcccec6e7aa8b8.exe

  • Size

    1.8MB

  • MD5

    dcd1d03f386dab945a8b534dac3d7622

  • SHA1

    181b3898125e89809f0a8a113ba76cca0eafe634

  • SHA256

    91d20ed7e7cb5e93f1a7c51ae70ff4f45bd444b9547f0dfad6dcccec6e7aa8b8

  • SHA512

    d42e5ae5cb69e1b26cbe56c3dada59cd03874228f82b66568a4daeddc854a68018f8fd31aa69ca2881042355f7df2d8cb10a3431501e79bc7d2fb5de40a10f4c

  • SSDEEP

    49152:Lpkf41ali1HU/bPs3CcE0VWPj1EFS6svxdZf4l0fnVB:Z1OGHcbkyctSgsZdZfG0fT

  Score

  10^/10

  stealcdomadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2