Extracted

• • Target

    7b9ee562e367ff7f578b1454eb1a546ae832e93c9e17bd2cc5733366936aafa8.exe

  • Size

    1.7MB

  • MD5

    feac2448deb7e632e5bcf94d02b40c6c

  • SHA1

    5e608482b9e67b6724daea2d12aac702113bdeae

  • SHA256

    7b9ee562e367ff7f578b1454eb1a546ae832e93c9e17bd2cc5733366936aafa8

  • SHA512

    23ec9e5cb9f97e4078c75e10abea4d7a6254f14f5391cdbc8c112ddf2bb2db6e4e99ef5096b6c68ad0d3d5d7659a03d094ce26dd6e5f00e4f4bd3b04c6d2f82a

  • SSDEEP

    49152:/oT2tslxfK1iIVawlZtAtsKF4mq+hAIJCqp3:/SisXK1i4aUM2KF4mhA+C6

  Score

  10^/10

  stealcbratdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2