Extracted

• • Target

    bba96c9d29c016a476eb149b7bda86ef059dc25246555f4212d95be8f98e3859.exe

  • Size

    1.7MB

  • MD5

    d54b0c8f7977a9e67948bab655fb380e

  • SHA1

    0ddd15bf45362013fb845f4b6155ab40f039cafe

  • SHA256

    bba96c9d29c016a476eb149b7bda86ef059dc25246555f4212d95be8f98e3859

  • SHA512

    839c0605b497a6e38040dc2d6e261ee803d41149177b87928d29b9d7302c7a59e10732cdffc2a990b016cdf8899a782f3f25307717709ee27b5f51928afc4ddd

  • SSDEEP

    49152:FNudjp3W9Su9p1y9+Wup3FGoL0XcS+kPe:/unGwejH00kPe

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2