Extracted

• • Target

    9c8f21261186119346f9503cade60f914eee5259ae158ee0d6ab9f4044c24217.exe

  • Size

    1.7MB

  • MD5

    7d7a9cbd9a9e351007c97f4188646364

  • SHA1

    70eabae5c5f46f92c1ec3b11a9ebf6efeb1c3e67

  • SHA256

    9c8f21261186119346f9503cade60f914eee5259ae158ee0d6ab9f4044c24217

  • SHA512

    bdbaf0d05d307ebc251326a7e81327d84af6e5f3a1974e945f9eedc507fbd8661c4192ac85ce2660fbe2a669ee09e208c6c7401991ccd3d0c11492b80113c8fa

  • SSDEEP

    24576:+RzYfWqI9zJ9mcDlFkQK9ZKTJdz3+qBBJzUMSlDQEVB2KsYZw2olUUzVodYtDO:+RSsNFQg/nm3iCBRsDr7O

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2