Extracted

• • Target

    random.exe

  • Size

    1.7MB

  • MD5

    46351c64c0b9125cd166ea7ffd2fe19c

  • SHA1

    96c9fc0b21f9f2b28726a6ce13b9ccdc197625b3

  • SHA256

    43b277bf7b530eb470cbcd19efdf730f1a20c0fad7bc06857fabe13c34cd9da8

  • SHA512

    bf99836d8fdfe49538616ff2e23755e37392469fa3296bd419e6367ae726a1300c5cbaaea69dfc62224d8c718d4eb2147815c47f7911a7c2c28ef6f99a5a89a4

  • SSDEEP

    24576:QKzZ1cAz0DnZtoEdfIlWvNFyakDiOH9IbKKe0i8jrVllFTYt9r/bXYDx+j+phY9U:5zZP2nft+lWXy1oKK/7/lal/01+a/

  Score

  10^/10

  stealckiradefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2