Extracted

• • Target

    a902e817bf2ad61446350609c8fb93b9218bb73aca9a1420eebd304cad4dff86.exe

  • Size

    1.7MB

  • MD5

    eea6ffe796370bf2dab3d76266b23f6a

  • SHA1

    ae7795f7d35915574965edefad957cc17008a2b3

  • SHA256

    a902e817bf2ad61446350609c8fb93b9218bb73aca9a1420eebd304cad4dff86

  • SHA512

    f3b3ea6a36a76a3d80201c5b79c7a53faf8016ba8f54b4edbd7f54e7a835ccaae70615ecbe4d22dce5379f48f7bf9ba7aa7cdc9e0db96151b49ea8cbaa2ea2a5

  • SSDEEP

    49152:LNBT0HaEo1FfN7IBTXRFIYx8XmRET4aQV8pfkP:5BTtRFeTBFI0JXdIfkP

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2