Extracted

• • Target

    72944c0e43e4fed6c5229bd604e47a6632db8a9abe3771a265fa33ab4d9ae45f.exe

  • Size

    1.7MB

  • MD5

    7b9823554a2a50cef42a6d4b399a03fb

  • SHA1

    1a8a7a8d0169c01377ab7f2888669aa769921276

  • SHA256

    72944c0e43e4fed6c5229bd604e47a6632db8a9abe3771a265fa33ab4d9ae45f

  • SHA512

    78beb3938f2a44bfda74ed4d02638b48a0ce0a3f48bef3f6c274e29979e11d477fb813e7be5aa2fbb950c9177a06d30a8a0e8eeaa55ff18310fce60386d7b53d

  • SSDEEP

    49152:vJndr40nWKw3+bFOVNCJdBiM3VAXJkUrUwIoy:D40rQ2BiM3aZdryoy

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2