Extracted

• • Target

    962d675cfea4802ded2e4a1f4b70044ff15988cb73e740037298d4b2b1891631.exe

  • Size

    2.0MB

  • MD5

    aed37464a2128c89076188d9f416401a

  • SHA1

    1b954f16ca55bbf51b2f45c6fb71d349de6842f1

  • SHA256

    962d675cfea4802ded2e4a1f4b70044ff15988cb73e740037298d4b2b1891631

  • SHA512

    78bdc21975e2d0c64e0b8af8e6f18d45ce1da4c9fb1567ba5304d426ff30ee71f2b0b772d16c8415e4260c8af2fb7b92d82ab89fcc67b3d0428fdc0b1ef21b5c

  • SSDEEP

    49152:BGrReYTSRc0aQu+Bt6LHQI7lhq3ZYph9GW2F9qMbFtdyjrtsvm:krg6qOWB8wI7/q3679GbF9qMzdyyvm

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2