Extracted

• • Target

    ee6febde7033e6de005058d3142c338ec996f5ede9fe0f39b0624e1ec0271326.exe

  • Size

    2.1MB

  • MD5

    1ad5e7ded8ca2ef443ccfa9c99c1bd94

  • SHA1

    3edf1c3f98c6d29cd0e83024b07792ac184ffbcf

  • SHA256

    ee6febde7033e6de005058d3142c338ec996f5ede9fe0f39b0624e1ec0271326

  • SHA512

    efd87bb9ef97614d2af87afec2f05fd4de89faf8134d04ba824d5c05e4f453aad71ad1a00cfd8f7870fb386b0ff1b892b8405953ff6c53cf00b4f0a2762ee167

  • SSDEEP

    49152:j7uq7Tm9F6Z7c6WPU5SFcNqByg0IEPCRprSwqI:j7uq7+6ZMFcNqB4wfrZ

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2