Extracted

• • Target

    032feb2031b118d540095ac8f923a1c75871a32ddc92a39efb8c796673828dfb.exe

  • Size

    1.7MB

  • MD5

    30a1dccb1ae00aba4155776ccc46d956

  • SHA1

    99ed961b69c67e2a9fd0fc3bff43f64eb43713a8

  • SHA256

    032feb2031b118d540095ac8f923a1c75871a32ddc92a39efb8c796673828dfb

  • SHA512

    30a67fb7f0b2ba254dd15d2409312a9f6cc4f36f809d4b1ad574a5d09cdde4ff2b845c149f8321f2abae9a2cf52e0e75725be82dc58610c49b56951193eeaa1d

  • SSDEEP

    24576:K7N6dixcFMHMGg3qpjDc7irOsNfUB4gECHBCyRTh2vJvL8Q222aMR/y7gwDeMyJ4:Kc5MsF6w7ivfUBoyBPy75eM1NV+q

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2