Extracted

• • Target

    06adfbf6b65db125bf077cf61e8cf7a19c0e191e3c379fc1d98df354b841dc5b.exe

  • Size

    1.7MB

  • MD5

    f9071a2645e842d87d99a209e698bcb3

  • SHA1

    e0b1650c137946661a8c819d298ff62439af8174

  • SHA256

    06adfbf6b65db125bf077cf61e8cf7a19c0e191e3c379fc1d98df354b841dc5b

  • SHA512

    747bb2b4af494e33fd7a3812250ddae4c1921eea79b107ec4fb633c1fd52e5483562264a681e461bb01c2054e0a2916d08de0e55e5624034445c79efc8aabe75

  • SSDEEP

    24576:2XmIWedv1RcxxFZ2RwbCAMoU1sd9AsKl/fu6VaE7Ny6xh4I4QVtC6eCmdiqCyxyP:2Xm8dOL2CrU1sUdTVhBQI+O3

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2