Extracted

• • Target

    file.exe

  • Size

    1.7MB

  • MD5

    d3fb62af150353d3cb05f84d328d5601

  • SHA1

    98be84b348beaf1abb2a9327c5918322e840a274

  • SHA256

    3a0642019f4c38e2b2b89e00492dfa809723534f7753ce480e01482ca191b950

  • SHA512

    428034b57853c7b0a9e1fd47590f9816a53ef497cad88bba5bf1094a12089c2022ce75be1cfe760da9342ef8d3adb853d70d01fe05f2cc6622e9c6decb91d0aa

  • SSDEEP

    49152:6wSCX3j6yHj2PA/8KcVFGpXudww4uoUcb1:6XS3j+AxAoXuww4uoU

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2