Extracted

• • Target

    16fce8d68b407f6afdcd1256bd455f59abe7aecf3c00f3f3c0276929c07ed644.exe

  • Size

    1.7MB

  • MD5

    d106a06a2d284e86d1bab683d9ab66b6

  • SHA1

    eaee0c75a6cf398e6d1d102936f11d7458c098ee

  • SHA256

    16fce8d68b407f6afdcd1256bd455f59abe7aecf3c00f3f3c0276929c07ed644

  • SHA512

    cbba0dc34f3de2757758455c6a1e99a143491539f2d4492cb87b9a9c27b9d3c93e398f0d24e9abb77c566d4658aeb1284d8b1da3c51e43e6034c5f6622861d25

  • SSDEEP

    49152:tFKphZF1SydD6CCd00P9PMmjfj4yAJFQ9fi:tFKpPiydD6CCBMO4yAJ0fi

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2