Extracted

• • Target

    0fe5a5638fe708a24667bddb8bcb1e0c20b2d16900a1b99191835b6c2525154c.exe

  • Size

    2.0MB

  • MD5

    5ec78504b25d8c39cb02870c39a81709

  • SHA1

    e027f5e029205cbb863d7104d9356451bca63e55

  • SHA256

    0fe5a5638fe708a24667bddb8bcb1e0c20b2d16900a1b99191835b6c2525154c

  • SHA512

    8c1d90ac6fac09c29d378a35c8b6792c80c87509045f4b2eeb36d4e21ef5c4260a74ae8efddc5ea03b7580395b3a0f06939fa941802a76c918af3c5585c90b1e

  • SSDEEP

    49152:C+F8J/GRpPlZtAxMejhOp6YfmW6cPPaDecdKkcSVGuzT:NF8JGNAlOp1eWfKhc7uzT

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2