Extracted

• • Target

    66c7b70ab45668ccf79506762e35bfbd22ab6c07689fc0fe41f202336f516688.exe

  • Size

    2.0MB

  • MD5

    0e5bf6cca8186ea2b2dffb910fe238e6

  • SHA1

    df4dab8d3fd6a0d8311eb72c64812f3d9696af01

  • SHA256

    66c7b70ab45668ccf79506762e35bfbd22ab6c07689fc0fe41f202336f516688

  • SHA512

    b18a37975d54cf80faaf529eaf9038488ad9ff50e680142e91237ebb43fcc8b6298da8e6ea5f6d9d2569d67877aa9deb1c76e945212b1734eba6d596a70d26c9

  • SSDEEP

    49152:ukzFs5LxFlAk/1QNTDko7qAq0eoWfRX3ijen+0NGITy4PA:ukzO13AVTDvqA9zqae+2TH

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2