Extracted

• • Target

    38a8423c2a8b348d00aa329fa589d63b52243f3a88b70e26d54b67f5e412408a.exe

  • Size

    1.8MB

  • MD5

    ff5904b78189f7d3d05990abe08a6574

  • SHA1

    f0188fd5eafe9268e34dc1a5162049704a70842e

  • SHA256

    38a8423c2a8b348d00aa329fa589d63b52243f3a88b70e26d54b67f5e412408a

  • SHA512

    e71d679fd3164cc8dd36e1d8b54a5ed7df3a6500d4ce29e48390ca30d9f17a5827b3288416f432afcd08283ec3d3333d355d7b3522da3c1ef11a3eec1d4cbc5e

  • SSDEEP

    49152:a3O68YdTskyseUJVH13DH2F+v73tJgy1dyB:b8TsRUHH13DHVztJT1d

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2