Extracted

• • Target

    d79cb3745a94eda6458658844222b689af75a0c9db9b3b0164ad15d454f3fc69.exe

  • Size

    1.7MB

  • MD5

    141c303be88b900bde3df51fb8f87b0a

  • SHA1

    26758be665fca7fb0e007147aa4234b60be1d53f

  • SHA256

    d79cb3745a94eda6458658844222b689af75a0c9db9b3b0164ad15d454f3fc69

  • SHA512

    af634d218720dde27cbf0f1a6d8f99e181dea0b2ea0d4c4cc0f8e9a31accccb9d5be57fccd825ef83b1333b4a9ac4ed6806eb78a9be921e4445463b2e04421f3

  • SSDEEP

    49152:vXwnELO1aTOxRI8Vp2qcjkQBqOq+51YIEXy8FllecC:vXwnEy1KOQ8VoOO35CIEJlfC

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2