Extracted

• • Target

    file.exe

  • Size

    1.7MB

  • MD5

    0f160ade68b51b895c10dab6f6388f30

  • SHA1

    aebc54157b912fb0c944b7b64e9ecf33a3a185bd

  • SHA256

    272140f21c46359013f46c642fe6df6c12504ca9bc9693dc6dd35a94f87a54dc

  • SHA512

    3a4e499696fb10d8a4c58ea71c22748bca2ab6029a1ea679feeb9959abe6e9a7d500127b856d9b4b63602decdd016f023b69832565123ebdfd0407d5cb3ab5ee

  • SSDEEP

    49152:42tss620CFSaWfh7tBI3X48MQZv1FG7sXeidvSPIl:42v620CFSfhPyNP9FG72etQ

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2