Extracted

• • Target

    00a611f2d2bb4ac3a0b25944e3d18f138ea855b55a925487951dcb758680e300.exe

  • Size

    1.7MB

  • MD5

    9e7f4cf6e18e8735f345022c80434165

  • SHA1

    557e50bff706038a308a12885cce092976dbbf42

  • SHA256

    00a611f2d2bb4ac3a0b25944e3d18f138ea855b55a925487951dcb758680e300

  • SHA512

    1f24a75a836c58fa059c21cc4a071746df6bbc09aef28eabeda360b765694900c0c1b40e120b6f3e6ea966871956828d3c609cb59fffd753a0d78305091f620c

  • SSDEEP

    49152:Hny/mLhM70gIsZeZnb4EsBtXaW7CQ/dxY6:HnWmLhM7JIsZeN4E+kUxY6

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2