Extracted

• • Target

    feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe

  • Size

    1.7MB

  • MD5

    b0cf5e71ca872709d9445931c2aaad6a

  • SHA1

    9793982f71ccab73d3dcc6ae13e76e537823f1c6

  • SHA256

    feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe

  • SHA512

    261f63dfcb6458f923cc0a0272a4bf068c83115ee2e838c79cc3055664959abd65413d3bd216b1a47706c39d7bff45d6b1ecf02d2926a65dde2845795d8e58b8

  • SSDEEP

    24576:oWMA+zJ7Cze7EbuKEEqlA0kce1dJOyZUR0m5K1O8Uu/4cBWEbR+wiWua5UYdcziP:l+zZCzMLKeljkceYyaiQ8d3BVgYdq0L

  Score

  10^/10

  stealclevadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2