Extracted

• • Target

    39a99fd12bcaa5df8f3e0a494c87d72336c33c4f07686e3d5f7199b1b6de1c8a.exe

  • Size

    1.7MB

  • MD5

    705242947c668181ba1d00b7b6d25164

  • SHA1

    cc46529fdcf545a625c6a434e58747eb67cc3fb0

  • SHA256

    39a99fd12bcaa5df8f3e0a494c87d72336c33c4f07686e3d5f7199b1b6de1c8a

  • SHA512

    b581b0e95a259022aa4fdd88152353d461f0a95ba4cc5cdda564ae3d2b3b3e2ac7c50e698a5369359dc3c02e0d3fb14820ee87cfcd56c8a70a7da5145b94db1c

  • SSDEEP

    49152:g8Z8ZqEL32zxEju3C3CIQWEmZrbQRuel/xG:gxqYfu3bME5G

  Score

  10^/10

  stealcbratdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2