Extracted

• • Target

    2141d9159c4fca891bba493acba71c5973b9d554e4b0552f4a87be7f3bcd112e

  • Size

    1.7MB

  • MD5

    952471642155df63bf9dd4bbd2828c45

  • SHA1

    7de09af139988b2712b7922220a68940ca6379b5

  • SHA256

    2141d9159c4fca891bba493acba71c5973b9d554e4b0552f4a87be7f3bcd112e

  • SHA512

    04debdb0c9a6761e0132e78536073c250b4d4b2d1be1e1761c6d2e388713b84dfaa80adc984de548bb42ce2156500d650081c4084b28f03b316ac7a18d996a5a

  • SSDEEP

    49152:uCwQ7K+cKolGbhsL0uTvllCef+9/6nZgRRq9eHN6:2QFLdQllY6n2qkHN

  Score

  10^/10

  stealcnorddiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2