Extracted

• • Target

    73bf8e4a7d1baa981576bd9789ca7b13f9e53424dc283000474753ef51c11f4a.exe

  • Size

    1.7MB

  • MD5

    cd917c036da4dc2b3e30e12b135a87e2

  • SHA1

    e1d0a610ebc4d4500d01ce193a803a94542893dd

  • SHA256

    73bf8e4a7d1baa981576bd9789ca7b13f9e53424dc283000474753ef51c11f4a

  • SHA512

    8f095fb21086ef7cf673f8eee5218592e7c0cf1397a2b4b11b7b5f29c0b6f194f1f1c8961b9218094146022d64d0093251d57d419a09b61d7a0571672b96c2fb

  • SSDEEP

    24576:FXRnTWS9M6G832tc8aegrm2rIEjvWDBqE0A+hBcwbPna7r4EK5DwUoza:FBaSm6nCaetEKDcH+7rD5U1

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2