Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    1e9b6d2b4d8278c86346af04463868a2

  • SHA1

    4fe92ae80191dea2916abf1dd9bc4cc8a2fd73b6

  • SHA256

    149b09de4a0e0dbecb7b0c6fcccd98081071fd4f090e6e25df6184ba0a5ddfd8

  • SHA512

    23725e7d0dcd87dd6d256146563e7e11286529f86adc87d8b3ffccee62a20fbef36e9ae34c5176c04e2b6a245ede06ca2e2130aabd47723fc53092de979b9e32

  • SSDEEP

    24576:BmPY2lQ/9HDKeFtZKu0WoX3BVp0GYF75ky1whqhdbuGW1Uu+PluVtSd71tvjmqFP:ao/9jxfZ7oXxUHxGylbeUu+PmwFnXR

  Score

  10^/10

  stealcdomadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2