Extracted

• • Target

    de0db7603189d02c7051013fe43244a3e86fbd2a884a733a64fed84836912e0c.exe

  • Size

    1.7MB

  • MD5

    13a85c121414fb45d5693a9ab8910086

  • SHA1

    040b4aa8746c65929784f80116bb13c7f125ddb2

  • SHA256

    de0db7603189d02c7051013fe43244a3e86fbd2a884a733a64fed84836912e0c

  • SHA512

    9c9d7a5e6cf4d76a79870b62a37984783c0ec174b7f2e4557154cd0632d6e2ee7943d9ecc6149eb09277ee1dff4d8eb2692ce60934d69eae97f80451344dc5d6

  • SSDEEP

    24576:2ziQSKhHhlq1saRXmIT7jgFY+BMbmUiMf7lvDrXmXa9UxsTXfEFnyWiB1FCtvk8J:2BSeHhKsgJ5mUVAWHUg1FCtvX

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2