Extracted

• • Target

    b0b08d2aee5fcf38d1e7ae60955a220223ddf3afd355a3adf47504cd36ec3dcf.exe

  • Size

    2.0MB

  • MD5

    4a30593e8cc4a02c72f225d1cf625f56

  • SHA1

    8d808deb50029263d4d970f4d751d03d35c231a6

  • SHA256

    b0b08d2aee5fcf38d1e7ae60955a220223ddf3afd355a3adf47504cd36ec3dcf

  • SHA512

    455bd20093d68cbc5ef870ebb498e452bc0f5aa9e4557faea5e5bb025672a23bc075226ca1ef05e55c9ea87465dd30b91311eef6131e42c92a6d4fff6f97f4aa

  • SSDEEP

    49152:Yco024bX9fz9ZZMwBI2Pkpg4Al6HldfjPgyMgSr9wC:UsX9fRZuwBY66FBPgyMgS5h

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2