Extracted

• • Target

    63d5dae30a2008d6a858e421ed4716c83b4aa8677c56d804e1ef96086ecff920.exe

  • Size

    2.0MB

  • MD5

    633f9512e18ffeee9daf308fc33c080c

  • SHA1

    2b18defa7720c46b847a3e81c67296fe5b4e3efd

  • SHA256

    63d5dae30a2008d6a858e421ed4716c83b4aa8677c56d804e1ef96086ecff920

  • SHA512

    247e92acf56bcd8dfdaa6816cdb565efaf9e02d2a5b71cfeae700168390fd6bad0fb27dde7371a6baf51bb4398222941f1c9e75c2bad2b9d115fd301919aa5a4

  • SSDEEP

    24576:Ag+VOouYY4dqYeDxp00Yp0nyvK/VYz+TrEqB+9dox6pRwyU0w2jDP+Nx+sojd2ng:h+VOout2eDxpoZK/VYGv6zdDFjJ6c6N

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2