Extracted

• • Target

    file.exe

  • Size

    2.0MB

  • MD5

    0a4f63f41d70e6b79b2cc22119464caf

  • SHA1

    4fda6082bbfd5d949b081f88299095ef3429aceb

  • SHA256

    c7e9c6862d2701d9afd0d255e0a93d901052bdfbfa4623139b2f7f0c40ca8890

  • SHA512

    0f0ac4d4f9127385c3cc8ea9f016bd69b9cc523deaee7c891fb9b9082a28bb82c7e2504f4e78f4c108b70a5dd37ec8b60da13b63da433d2c1a43f6e741b0890a

  • SSDEEP

    49152:zCPFq6xio0YPv7Uc4O3GdbM7DBm93oNdlVqNAr8afZmNVg:zCPZxh9H7Uc46GdQlm94NdlffZcV

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2