Extracted

• • Target

    11a3338ddf08753ce32f38b6ebdcf00537f7abebd5358c10053d48dc715d7ba1.exe

  • Size

    1.7MB

  • MD5

    1a59bc0d3d995fecf3d264ed8e97966b

  • SHA1

    619b8818b026b5a38edd1e0ac4e9482accf90440

  • SHA256

    11a3338ddf08753ce32f38b6ebdcf00537f7abebd5358c10053d48dc715d7ba1

  • SHA512

    2f6fe5f39f333f642db8ea97a3e0bbf732830616e67becb46bc14e84d883ac7e6c2eec6a16d13ef5d960294e1ced5b87647b75c1b5e659397c28d2fb1ba88d46

  • SSDEEP

    49152:pOC+TpfvWttDsNO9XY8Cg1EaaNMSs5Hpj:StvWtVfuMX5Hpj

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2