Extracted

• • Target

    08dc99ba8da04f16d328f32f11c7721366ecfaafd04c21e7b3c0a3a2eb794dae.exe

  • Size

    1.7MB

  • MD5

    e0907cecf84597ff5476178c7addd920

  • SHA1

    d8deb30212420bf1ef69199146d869cf5408e836

  • SHA256

    08dc99ba8da04f16d328f32f11c7721366ecfaafd04c21e7b3c0a3a2eb794dae

  • SHA512

    8c51b90d7aef29a5f3e7fe4410035fbdc876d4a4966e119cecdef672fa6abe652762faec5d214cd210ed9c185083718946a8434a0d0fe24a20ac9793339f1336

  • SSDEEP

    49152:4yh6egfj+MefPacdainejo0OeG3gMcHgv/5yD:4yh61fj+5yc0JpNFTE/wD

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2