Extracted

• • Target

    2e9caa8ec6faf2bfcc89a031cc111e60654107d5979a197d1727266dffbc2b1a.exe

  • Size

    1.8MB

  • MD5

    4cc6d797a10ba2b6f877fc893f459f67

  • SHA1

    a0c6551d531895b1d716a6f2e89da0cd0721f35a

  • SHA256

    2e9caa8ec6faf2bfcc89a031cc111e60654107d5979a197d1727266dffbc2b1a

  • SHA512

    989107424e4b86ca8b4e772129314a922d2a9fe2ade885f28ae56bff2fce3d8aa1063917c6cb31dde8ff56e50fd9d77738e18d07173cf1bef32e78c1fe397bde

  • SSDEEP

    49152:kLZosPz+2mGYY150iW1ZDU/rCLRUYwmWX96nItpOv:0osDmGYEYvDUA2DtpO

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2