Extracted

• • Target

    6359491137ce7e2e785e947167ca05222ea40b00bbd8cf0ba93f2650a8418ef2.exe

  • Size

    2.0MB

  • MD5

    f5c758d276d558b89a26265c804883f1

  • SHA1

    838178b0512fd3f0c9dd19bee9cc7d5d00dd348e

  • SHA256

    6359491137ce7e2e785e947167ca05222ea40b00bbd8cf0ba93f2650a8418ef2

  • SHA512

    68ec4ecb30b5fc24840808cf1bd0019fd10c1624992565f93dcd456dc24e65c61650414e362e31ee9d142108181a98a9218b5fda4b6e5449a89da0c89ec1d605

  • SSDEEP

    49152:OrBhFCoKr2CPpzoFcCDwTGKWZw11c+j7yhguhYViX4jOFu73wkKPVpcaxbRU1T:OVCoKrHmZD6G5w11pj7yyyX4KA3ZqVpr

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2