Extracted

• • Target

    86547b0f3c6512363905143949a17741e7d57e1015c4e71953ca3785fcac5be1.exe

  • Size

    1.7MB

  • MD5

    16f2b35b4a02ad30cbf86196d8415db1

  • SHA1

    a18e1c23e750d33d149e82117cf0aa6dccb2545e

  • SHA256

    86547b0f3c6512363905143949a17741e7d57e1015c4e71953ca3785fcac5be1

  • SHA512

    c9e6129cbdc1f96799a7b628b69291e8acf49780a2ecec77c25212af4fd7559b804294b7f9d966ea6c188de5cc125e0d3bdf9019a419e0fd126edf228a88dfc6

  • SSDEEP

    49152:VScskUnQSphFVsfByU+lxLReKQqQ96QOvXTCKBk:lVUDCmlx6fOP

  Score

  10^/10

  stealcdomadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2