Extracted

• • Target

    136dfe4a8f2801c7836bb2518b2eb57142e57efb77a665830a00335fdfe0c2bd.exe

  • Size

    1.7MB

  • MD5

    d90a0fa7d1b136c6aaa035f6bc5602fa

  • SHA1

    1e236ca8b781f344a4738c1810b3c819ec72fac5

  • SHA256

    136dfe4a8f2801c7836bb2518b2eb57142e57efb77a665830a00335fdfe0c2bd

  • SHA512

    161375c3c6d2abea6d3697fe79832c1928cefd2529e222f444f057ffa282eed8e7780c683a64903f16732022f0629c26826abab4ceacf9b78cbaaaf3d805e67a

  • SSDEEP

    49152:toBu4wjPsAgeUE+SERjvwfG1SxNGtvloF:+egJvOGkbKloF

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2