Extracted

• • Target

    a4d3e8d67b995319a03f414502949018830e67d5f98e18ce50d1fd6199d0aa1e.exe

  • Size

    2.7MB

  • MD5

    081826151309ad9d42290bd44a886614

  • SHA1

    3d37094b9a5780175e56160936626433de21e348

  • SHA256

    a4d3e8d67b995319a03f414502949018830e67d5f98e18ce50d1fd6199d0aa1e

  • SHA512

    ca9e2f871325d79a20ca275d34f2eeb9cdf86d22e88cbbaf164a1e24dd70954746c9ea656575437e5552e9f3c02f90ba8b0959cf1097adb81633767bde944539

  • SSDEEP

    24576:nLk+07DQLpG+lqM89oNkTf4qdbiw6PF1NP5Z5ksZ+fvy2oSnNvmAQ9SJLWsfNp6R:LWL+lw73QVFbyJoSQ9wL7T65qI+1k9

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2