Extracted

• • Target

    fe3e25e07d0c6d9d56cb067571e4dbb7a994c90cf1d7689ee75d83b44e4a8e39.exe

  • Size

    2.0MB

  • MD5

    3c56acd0bae30fd27c53a414f64ebb6b

  • SHA1

    811c81c4b8eeebc38affc7708746e66245211e21

  • SHA256

    fe3e25e07d0c6d9d56cb067571e4dbb7a994c90cf1d7689ee75d83b44e4a8e39

  • SHA512

    e726907f1991323b530d9b4a43a3ff0f27a4e92a3432cef9671ceb816021af696fa9f6c18f1351194aeaae1c713285f8ecf11752a59759ccf3656c04d225e2b8

  • SSDEEP

    49152:qKh7vTZIHk7jLVrz9jdU1hFriuMMcizpZ+AFOpOax/:qKhzHlhj2hFrHJzpZ+AEpL

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2