Extracted

• • Target

    d1b814f42bd6e1bef04e8fa411c9d03f70ab8fc5456712150796cc09a0ac14b4.exe

  • Size

    1.7MB

  • MD5

    960d39578d3d49d18bdd39fda720df2e

  • SHA1

    b5c51d4e5ecb04da63952367ad43da2ef354c3f4

  • SHA256

    d1b814f42bd6e1bef04e8fa411c9d03f70ab8fc5456712150796cc09a0ac14b4

  • SHA512

    b2181eb557a46a8e5376d31497d04aecb3dbc979ff4d9fa6c4651ea26bddbe59ed9f04c79f862d525472fdededa5782a358ddcb9d9cfbebb7b47700e19f8f7ab

  • SSDEEP

    49152:ZUq3qa9zj4RO/H/LtUbkMQG7kMHS2vav8NKVnwgwV85I/E8Ic:7a4X7/KbkMQG7nn5hgwyK/EPc

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2