Extracted

• • Target

    file.exe

  • Size

    1.7MB

  • MD5

    46357450c18691d06fb6fb48b1551b35

  • SHA1

    da76c0bf347ef897c08632f7fcf070568163582a

  • SHA256

    9d3adf953199b7602139a93915d8398bba7626548c5e34b0631e88b01fcf4433

  • SHA512

    2d58a31991c8c9e53dcf25e6b49a0d3c0b969c0addd1848c04dd4b905ebdb85b057ae4b3b2bfea5fc605cf41a9697129e88b74d52b7f8d1eb71300ac447306a6

  • SSDEEP

    49152:eoxNmI1jk3743Ti8Q8D/neKf6wv9x5uecVb6FXgvmZ:ehr4jif8DPRyheK0

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2