Extracted

• • Target

    6800cb56d8bcd50e6380d8c3e3acb932923c7b2db5046370b7564ef439502ea0.exe

  • Size

    2.0MB

  • MD5

    c57aa72ced3f3b2b7a9bb383ca178525

  • SHA1

    cc19ccb0c3f2b77e6185fb83e19779864d9f3754

  • SHA256

    6800cb56d8bcd50e6380d8c3e3acb932923c7b2db5046370b7564ef439502ea0

  • SHA512

    2d5f276291b8f041ecf654e494cef66a42146c8d5529fb9f58a10ff0669c0237c78afe8fa11bd4fb753505c8eb50721e3c0e84c61596ae5aaa2e2f77639b0b8a

  • SSDEEP

    49152:ihA6vmgWWF7k/hRJmjYxKpV1cyqOFzgL5LIsBVbM/8X:yAa97Jj8MGe+IsB+

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2