Extracted

• • Target

    file.exe

  • Size

    1.7MB

  • MD5

    efbcceeff7fbbe424508e4de00ad3ccd

  • SHA1

    33574ecf95f1ca351c97fa11c439b7679ae56ac6

  • SHA256

    59d0f4b4643ad0497f1d181024953aff948698a7e749da8cce46f1e86642ee08

  • SHA512

    154aad64a9cc25915986190df630b889fe41207d434831ff606f3212994bcac8235763d43c1be4d1bc98f1a712e27f6e06847a38b5c9ddc14780a587b9416e9c

  • SSDEEP

    24576:ENEpFHR2c8uU5PagNqNMLs7G27xKaPuIPAssGEriSBh/3HGfMgVpbC5Au9ykvDqO:Eqd8FNqNMLs7Jz/xEnh/ANC5V9t7hKI

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2