Extracted

• • Target

    859a8396da0d39d5a69a884b8612c567024fb274fa9d34cde309122689136c38.exe

  • Size

    1.8MB

  • MD5

    77cb936315fe3fae321dac2b603487ce

  • SHA1

    4d8476cbab55f6cc720d3b41c1c976bd75b5ef4c

  • SHA256

    859a8396da0d39d5a69a884b8612c567024fb274fa9d34cde309122689136c38

  • SHA512

    081129239291846d3e068ce1c10906534575a5b24ee8ef69d038612ea9185c2b8a77077db46f50645f0b655cbfe6ff1fbb6840c994db7d6a4d240b39ff63f8d2

  • SSDEEP

    49152:JiX+itJUKWDp8FuMEUA8d74ba6nGvRYgEhXCK+JP:kX3p/uMEUOb1n9gEhbO

  Score

  10^/10

  stealcdomadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2