Extracted

• • Target

    6ab0865ecbaf0e450e68a7d866f036113b50ae6edff09b1f0e41c2514cf72233.exe

  • Size

    1.8MB

  • MD5

    e12ed88e4c214b23dfbd11ea91d2ece8

  • SHA1

    2a76376af58e1a12f2947de272a3e6ebb8174fe4

  • SHA256

    6ab0865ecbaf0e450e68a7d866f036113b50ae6edff09b1f0e41c2514cf72233

  • SHA512

    6d6f7213a6eaf5b5545be1d99606827c00613cef505188b46fb4e9f4149ccc047d8d2b620dd88aa33f6dd1d67aed3095eb64f853a068271d1418743f2156e1a7

  • SSDEEP

    49152:nQKmJu3h2Uwgz+LAPgzIL3rHGloGeNW5Y6:nQPuqi0A+U4oGeca6

  Score

  10^/10

  stealcdomadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2