Extracted

• • Target

    file.exe

  • Size

    1.7MB

  • MD5

    e28eb84120c7318b0f8fa7fc2bd79398

  • SHA1

    f4a8dcebc79558c8640ffc6c0471c6a173d4853d

  • SHA256

    0a8d7dc28c9ef08e79873c4446878a4f5b8a443fa31b4f454d606c4419a338f5

  • SHA512

    cafcb6ca3a05f3b494592ca9fdd58a022befce7bf89786a99e57a3e8df2c86a22481e9a36615147adab3ee0db8a3f55cfecc4050fce9c4921c63a9caddd03b43

  • SSDEEP

    49152:ZodsgxZyG8/AEaAmk72H4wXlIJgk1jcz+D+:dyZyG8/Ammk7y4wX2Jgk1y

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2