Extracted

• • Target

    15d55e886566f3da849370afa83b54cf3be37b95be32bfab0ef36ae56663c6ec.exe

  • Size

    2.1MB

  • MD5

    11161c01ba8c1c0639c29519d9a55133

  • SHA1

    6f878ae9e8dd2b2bd17f10c6ea340270ba52d936

  • SHA256

    15d55e886566f3da849370afa83b54cf3be37b95be32bfab0ef36ae56663c6ec

  • SHA512

    4afbc5e442452f7ce7f103b47ff7e80714fca5398a52c8d93dfcfe8896ca68b3a3ddd79205fbebb3bfefd17391c6501615088d385524cd6717acb6835edc0a55

  • SSDEEP

    49152:m9V95qi+PiSkTxj+FA26eUKXs7IUB4cqKRRJFsFEY426:6VZ/K22MGskUB1RRAaq

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2