Extracted

• • Target

    635cde2d96fde23358854d9139bc7bcc64e806f4590af7423fe5bbebd3804c91N.exe

  • Size

    1.7MB

  • MD5

    6c0209a50a7c1e753955748128dde270

  • SHA1

    bb4a9ba88c02a9af90e133b1e04d7a0de8c53a06

  • SHA256

    635cde2d96fde23358854d9139bc7bcc64e806f4590af7423fe5bbebd3804c91

  • SHA512

    1d99fac2ddaf013932b5a1924b49e1b4615e0ff2553fa843cc4fefb234bdb15b36cb242dd706b05c85b51869cd319cf493631477bcadf6b816f31b116412ac35

  • SSDEEP

    24576:/XRnTWS9M6G832tc8aegrm2rIEjvWDBqE0A+hBcwbPna7r4EK5DwUoza:/BaSm6nCaetEKDcH+7rD5U1

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2