Extracted

• • Target

    e45f5355f8b2bb64ba940220e643d632ea4469c2be61ca107d8af31709efb458.exe

  • Size

    1.7MB

  • MD5

    71a545e3b2110df4ce7ccec9dc2a4f9a

  • SHA1

    e3a2be77d404af85e1251918a9c8f01c5586ce49

  • SHA256

    e45f5355f8b2bb64ba940220e643d632ea4469c2be61ca107d8af31709efb458

  • SHA512

    249dd250472763c76934610e5838620e2e21b6c66ffc7d9de88a0d74600a63de79545db98dda43e8f07d5261bbdbd94bb6c5099a00f905f0ddc18a4ba7b11831

  • SSDEEP

    49152:tdn/E1sQ9syY4L4odaX6mnFoHHdUUTCgH:t5/Ek56VHmUe

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2