Extracted

• • Target

    f4550f78fc5ec7db14f88f4fcf5e33f3cfa231eb4d6a31740489e9aa54a29934.exe

  • Size

    1.7MB

  • MD5

    2a5180fa99c0de75ccd62e94f2aae836

  • SHA1

    1275aec60dc64f9905643489eb6fd72f89e6c25d

  • SHA256

    f4550f78fc5ec7db14f88f4fcf5e33f3cfa231eb4d6a31740489e9aa54a29934

  • SHA512

    4c0af282f816e68ab275f80dded7fca21dee1544b4be22a08ed9efdad166463cad3b388fa1965357d7cbed513a7653245d646456c1747e7e14d2f4b0babc09c9

  • SSDEEP

    49152:Hy/s5n27wlhMnUTrKr6oyqgeuVZMyBx4Bxa/ErWwlKWt7/h:HaknIe7q6oOnpIBdKMz7

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2