Extracted

• • Target

    db63280686c703c78d5f728fca8a75f912f08f2ac2c55c30a2bc2ceb7a8f89be.exe

  • Size

    2.1MB

  • MD5

    bb4d5f01b5d4c11bc6652b32bd9e29f1

  • SHA1

    de46bf6f9710fe3857d5f2eaf45700f7c0f34018

  • SHA256

    db63280686c703c78d5f728fca8a75f912f08f2ac2c55c30a2bc2ceb7a8f89be

  • SHA512

    1aa562a41776b33d11d7e9ec8d44c4b749319e6fd80d2a152967465110a8a63931b97eb08efad48a65bc8a90c34adc915720723962d67edc01d18ad6e417bb65

  • SSDEEP

    49152:4BKtmBSY8LSCAQaWRHa/DfP0q69adn2v:SKwS/LSC/zq0q6On

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2