Extracted

• • Target

    file.exe

  • Size

    2.1MB

  • MD5

    a36972c5d2d27141d0844e31fcfa47be

  • SHA1

    9260a0a903f7fab66da7f9e9ed1ad3fb871ec9d1

  • SHA256

    bac7dd5a441eb887bd4f9e47200cde0555e5dc27d8549edcb015727a668a64e8

  • SHA512

    8491525a33cee794a9e358d0935a88c9cb27b10b15154ae14bddeef6627f632d2f57a5e6018d2a677e75626fceec9f9bcd08c97777d2f5d3158107f2b531eaff

  • SSDEEP

    49152:ZWaQ7WPKsTS3dNkRjOl4b55EALTXs0iaT/+DESb:0aARsT4sI4bkA/80J/+DES

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2