Extracted

• • Target

    C9SUM_file.exe

  • Size

    1.7MB

  • MD5

    e0205bfeadfb01c33d5a13ede54fbf10

  • SHA1

    3ef5bc11132a9dd29a98e80db03f4c19494745b9

  • SHA256

    6b6a89b114bb94bef88235b97bfe7dc73933be77b833cb7fc522def6f37a415d

  • SHA512

    1d5d157fc2078b2db86e421057a52fc47cfe424fbedf6eec6865ab84385bfb8c7ba454f8e5a9d58712cf1c1346f633530649742e72e2cb576a14164af29f289c

  • SSDEEP

    49152:2PNQ5shN9Z7wV3ZTcAPAPijxCOwQBukm:2PWGhjZ7sJPP5jxCODUkm

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2