Extracted

• • Target

    f4ed4f57a7e4e56751abe21cbd71ae96f72af06f340a7f1a443e5ec09c6e81ec.exe

  • Size

    1.7MB

  • MD5

    ae317d18bc4ca2596e61445e70cbc6db

  • SHA1

    62beb43b116740abd9c2af0fffebd823748f62a4

  • SHA256

    f4ed4f57a7e4e56751abe21cbd71ae96f72af06f340a7f1a443e5ec09c6e81ec

  • SHA512

    69bd0757e46516f0c167de05fe9102e2bfc3858389d5d3f43b99d64ccb897fa2245d07a8210d6544ef4da39f985b446b5245503ffd8e01a182e69e4d771a42a0

  • SSDEEP

    24576:J+ZNgCmBvXk8sWZamLdRWaT7pepbh9ujtFPxfXul9vwN56X9ZX/PKyods4VFOu:JM1l8sWZaKHFqujdP3yZX/yfOWO

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2