Extracted

• • Target

    749a24775a9225dd27ed9d457d9a82ace5122cdcaaef5069ae3e802464e2c77b.exe

  • Size

    1.7MB

  • MD5

    7a3b3989f1f3647dc9188a185b345d43

  • SHA1

    475a5d5e48c0f25f8083ff7657e9d6958e39d2ad

  • SHA256

    749a24775a9225dd27ed9d457d9a82ace5122cdcaaef5069ae3e802464e2c77b

  • SHA512

    a0709cbff8c8a4a55de37bb2829c1b7922b96d5e74e71655d932a7bc355d6ccbeba0ce84f89698439ff2e3831a671cea427785d0f0024731bc04a6390a48ac8b

  • SSDEEP

    49152:n+U/JBdKSFgDBdYxZwTmyVy+wXqw/5v6k7eWZy8SwHl:n+UxCIgB+IqAdw6al6kKWc8R

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2