Extracted

• • Target

    73df94098c3acc25abea1efd0d52fb2cbbdd89fb17ec01523aa7afdddcdc5881.exe

  • Size

    1.7MB

  • MD5

    5bf14ffcdce82bc2bfe3fdac59fe51dd

  • SHA1

    111cbbd1f261eada0f3e1ca97ee345d14b61393a

  • SHA256

    73df94098c3acc25abea1efd0d52fb2cbbdd89fb17ec01523aa7afdddcdc5881

  • SHA512

    4dd1144fe713e92aefba51504708bab1e88d443d4a7a90a33240e8fe7367db4b6592ab18f05ee950015acf0067b446ef2ca62df78dfc551ad0ee89857630c70e

  • SSDEEP

    24576:M8ZtqtQUeQK5wHm3CZ7IFcLPDornR9QAOnKtmp522vqRqHvIej:9N5py5ImLP0ntOKYD2ijgW

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2