Extracted

• • Target

    8e35f19ec6c533ae5add9613db1ddd42b2c0e21b8e8358b91831b6a417bb6f99.exe

  • Size

    1.8MB

  • MD5

    e7711723ae26dc35121612d3cee81ebe

  • SHA1

    df4c1af09b0ea65ba246999fb04614e230418c49

  • SHA256

    8e35f19ec6c533ae5add9613db1ddd42b2c0e21b8e8358b91831b6a417bb6f99

  • SHA512

    96f09039719e1a53b01e02f5786f723de81afba5ebe9f2d24da947fe0afac0384609e8d6d70bf009fdf9365c3f3b427ad146d8492218843f59204ad0ae9fecf6

  • SSDEEP

    49152:t8ATylKYvKdpifRxPntxjWWeG/CHYZO0FeW3:GrlKEKLOR1nXjGYvAW3

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2