Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    93db12453ac29ad390cbd66f4b6dfd52

  • SHA1

    14dc9072be488c339f9c2bbc3711d9793bb7218b

  • SHA256

    afd87eeb51cb2bd9ed4b52f0151ddf1f540d6c9fffb433eab0063c7edf1d093f

  • SHA512

    e6bcafe83356e62d24be04888c7b303cf7d873a2363dca7759602ff2f3b04193999e20499d70d12a46356e33da3f4193d583b462160f8bf3f57d1ca62274fe65

  • SSDEEP

    24576:bmihk7ZuwYJ+DCdrYD/dqwE2rXMp7kJ/6u6X0yfDAghh4V9OgYX1OzckEg8tvzWJ:hkzcygNkJCuViQ9xDE9anp0pRs/DcW1

  Score

  10^/10

  stealcdomadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2