Extracted

• • Target

    f68653355038a7fd7dec0d6abcd5b2c7be680e908251da89801bf0f06ae248dd.exe

  • Size

    1.8MB

  • MD5

    a62bc779d59177e66e564da2811a2795

  • SHA1

    076a0142197cd95a6ff3e0944c2e755e978d0047

  • SHA256

    f68653355038a7fd7dec0d6abcd5b2c7be680e908251da89801bf0f06ae248dd

  • SHA512

    9253f6aae80c452bba627d0782aa55315e3fc8b7a28153374a5e058f1d7eca3150af517f454041a84696c8be19e6f59a4d80327a10520d90e26c3a7527101814

  • SSDEEP

    24576:40IbQoYLzCT5a+MeJF96Wdytbc/rtKIVV82FIJc9XdMUpQKw14nUt71DNwjKa9ab:EkmTPPGWgtbczPV9KENMU91671D3ac

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2