Extracted

• • Target

    3259290c189d3a3d59ee28223294cc53e2447d81e1a01e1a5e0139be27541657.exe

  • Size

    1.7MB

  • MD5

    ad2614f8fc64b80170d83371df79985c

  • SHA1

    a1cd004ba4f69b78b293fdeff44f5704482eb648

  • SHA256

    3259290c189d3a3d59ee28223294cc53e2447d81e1a01e1a5e0139be27541657

  • SHA512

    354b41d4ac30b6725659d17ea2e63ed50eb565aa2a5a6df98042ab1aabd6293469554e5af7b8995a78ab01506f832fb76a2e931daf2949be7e5c2ae15dfa9724

  • SSDEEP

    49152:ihJVJIvB0kky8gxVCGk62Uza3lcpDcDoI:ihuB0kk5GCL6va3yFcV

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2