Extracted

• • Target

    5d7b7a5d6a3c291e33347301f3b116a375f9709a3f4ea5c3ec35eacaae59ca1d.exe

  • Size

    1.7MB

  • MD5

    61acee13f680dd57a06b13d1cc04cfcc

  • SHA1

    11415b4452ac82299c47e10e981e8728a57d891e

  • SHA256

    5d7b7a5d6a3c291e33347301f3b116a375f9709a3f4ea5c3ec35eacaae59ca1d

  • SHA512

    b4458be1c6bbb29c8d2853bce7fed4237f2c8151314cff0a94587e435a8783b5c34e29a0cb6efb7979fcb2ce8f62930dc2d79abe55c6c126f56f8f328355ef11

  • SSDEEP

    49152:F2I9nUXPhLNmDJvIB8AXnTP7X6MvfqehBg:pUX5LiJwzDP7tvyqB

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2