Extracted

• • Target

    ee6ba25acbc8d7297756d3fdc10567ef6d183cbf81a140af6f5bbd191e189120.exe

  • Size

    1.7MB

  • MD5

    972b66c860f95be3fb1c78af1011ace7

  • SHA1

    5d41b597ecca73055a45533d38d6c0d3509a3197

  • SHA256

    ee6ba25acbc8d7297756d3fdc10567ef6d183cbf81a140af6f5bbd191e189120

  • SHA512

    895d7516bb15edafbf2374c2e4b0575c25e533dd7599580865911244e2c425e1d3bc26af543ef97bc85b61dd803cca2a6c54be48daead919eebe16a0eb2c58de

  • SSDEEP

    49152:dIxtA6chbBoHdVO0aIVzb/n9PmZtdS0nap:dIlhfO09zBm7Q0nK

  Score

  10^/10

  stealcrenodefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2