Extracted

• • Target

    random.exe

  • Size

    1.7MB

  • MD5

    b6ffc39dcfeb0b682bffea56a56ec8d9

  • SHA1

    20bfa4039ad577ddade423bd283ee462891cd172

  • SHA256

    707661ffc447e84fe98b946e5c58be59eca9a4638526a29bcf196491591d4a94

  • SHA512

    3191c4f5ce8ec7861abdadedc07e8b0bf6582deeae894b78cd131de2d2363ee384c24a1f9aeb67a3d0f7892a5b933f7f8aa4abb609fb5c72153b358231ecc182

  • SSDEEP

    24576:avybTMuQ9LY0z2rEBo8RJrjLWr3QEckgEszfQubmA4AmjuH0mOI52SNx8sb9V098:aqbTQ900SrEBDJHDzorduHgI546qS

  Score

  10^/10

  stealcrenodefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2