Extracted

• • Target

    37008bff1b7f3719aee4bae2d90ba57c05618731bece25285e44160137e9c1d3.exe

  • Size

    1.7MB

  • MD5

    02fe6d790607494b5b820f41cdad2e17

  • SHA1

    1e526eb65c6c1677ced067310193991805faeea1

  • SHA256

    37008bff1b7f3719aee4bae2d90ba57c05618731bece25285e44160137e9c1d3

  • SHA512

    afece157f8dc32d871b23105990f4504be6b021580c68136a92de7421b8085d987e6f355d7bd760416ab40c64623156c0f7acba1e07e33ea94f6b860e436b904

  • SSDEEP

    24576:kRLj6R+0WGiGrja3PxORy383AHi9SbjCUozzhWRDFo/pnml2AglxMZ0d1Hm1CNB7:NRPWKja3JitQC9bNWRDFU22AKGwY

  Score

  10^/10

  stealcdomadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2