Extracted

• • Target

    file.exe

  • Size

    1.7MB

  • MD5

    6ae8d6dbe0f7340866c08c3f7b65978a

  • SHA1

    b1afeaa2019c2df5c0be69191ed9c91ba0af72cd

  • SHA256

    425637dfc7232d7373898820b23226d268bf36496b766b5e367a06855864549f

  • SHA512

    b813ff37f5d50473cc7c874eb35656c1faee5fb21e3f67c235c68553aab7769d87021c1c70efc2259470ce7a2f9399191d7b73c0ccf20bceb2b6946bc5e34961

  • SSDEEP

    24576:8Y+gq4ZwFfNQ+eMiqVrQq+7HFycKspltUVyY2m6JfYNEor14HJ/uH+xW6CS6fzkL:8YqLFS+ec0HFyDspbu6JLOcnbEzo874

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2