Extracted

• • Target

    8884a1de775b44c1048c671ce5d571b357076cf1efdb254b660d51bf012fba8c.exe

  • Size

    1.7MB

  • MD5

    629ed7eee0ee817a48972c5b01ae0275

  • SHA1

    e701b6bf02d4bf6a7a827b3f927a8e3e7ce909fb

  • SHA256

    8884a1de775b44c1048c671ce5d571b357076cf1efdb254b660d51bf012fba8c

  • SHA512

    2cf8ddcc70eee26f65e971e9bdb13a8f18dab5a0cdb00326fef910f91d87e5c56e6cce54cc1add6660d490b23834acc3f7d329474e215bc8b13ba811ccf422f9

  • SSDEEP

    24576:XC5gNZUIfT0CqoB5qb/7yMYDC2nx1fE5P2QZaU80vClYxUKUp3uUpoXX4r4MM206:XGE0/sqb/7y1na+QwUfZUt+FX76Tkm

  Score

  10^/10

  stealcdomadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2