Extracted

• • Target

    d2c483f48606d2239084e9f2863b5a83303c431c9d0bea2751196188edf1dddb.exe

  • Size

    1.7MB

  • MD5

    22f1b1157f590899f3cfc12dd73dd2db

  • SHA1

    98a6d31b71eddcd278e715fa1c95838ff88a392d

  • SHA256

    d2c483f48606d2239084e9f2863b5a83303c431c9d0bea2751196188edf1dddb

  • SHA512

    b31394b8e8705d64066c58d0d01cae21d1fd9556ed64780950fc18646531c39fe4fc281388b69de099c1e95e977fd96a7701cb78b12cf7ac54fcd83114babc71

  • SSDEEP

    49152:j30M2tfC22WnKWP1V4xV0S+h3lTlacCoUKJ:j30M4fL1P1qxV0S+R/sO

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2