Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    4aa6455467f057d4ecc679594c842f1f

  • SHA1

    77fc6e6b77596088193d357ab7be0a2412920169

  • SHA256

    3252882deddce18bdd91379c9e9481ca36c045a5550e12465893a617022e62f1

  • SHA512

    f9a555449e8b50e13a5c574b9f764d4ed52deb0a6e0f76eff5a9af42a90aaea1c729e4b753d09f0b53099091222203dc74ee2ed0c4f4fe92b23409bfba3f6ad7

  • SSDEEP

    49152:F44DpqrtczV4MzyNqeTV8wu0DVgJrf/T34ohS:64DYr+RnzSmBYAXT34oh

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2