Extracted

• • Target

    ac58e9eaf21037b02fda46678d5af12713db0306531b9b282d77cac16b9f3e18.exe

  • Size

    1.7MB

  • MD5

    453c59afd11e10b0094658aa65b9659b

  • SHA1

    89083fded0b001e296e5a9c8447a5552a55e0065

  • SHA256

    ac58e9eaf21037b02fda46678d5af12713db0306531b9b282d77cac16b9f3e18

  • SHA512

    f1ed0f85497b82e5429c2a0c224cff479488556deefb7e8074d77d3d669ae978aeba668e9feaf5f13fdcfccace844ab2bd6ea2838775f13d954122319b2c048b

  • SSDEEP

    24576:ojbkK0RLYofX1IirjhZkrhKfp5AKA/osc3Ye5oVxhJkzlo/HrLaKJp4:ojunfX5jhMEfvbsc3Y3DkGzL

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2