Extracted

• • Target

    ab6ca57559ee60d91fe5206b830b0c4ec7e28d032bf9313582aad6c7e84e42e7.exe

  • Size

    1.7MB

  • MD5

    57bb4cd54071751d43da290c1c22e00d

  • SHA1

    b8877f045e17e3349ee0c169a1beeb667509fd0a

  • SHA256

    ab6ca57559ee60d91fe5206b830b0c4ec7e28d032bf9313582aad6c7e84e42e7

  • SHA512

    cf793ad9b89bbff3565cc028dd5bce0f1581c8ac8c99c1d4b2a09f90741514c06f6524da83414e836db0cbb2de5a3edc512f91e7b9f16dcc191d693a0870fd4d

  • SSDEEP

    24576:K7N6dixcFMHMGg3qpjDc7irOsNfUB4gECHBCyRTh2vJvL8Q222aMR/y7gwDeMyJu:Kc5MsF6w7ivfUBoyBPy75eM1NV+

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2