Extracted

• • Target

    b250877cdcc29acd15fff50564c19af7e22e0a6b096c095a8773e2649047dba2

  • Size

    1.7MB

  • MD5

    f0e444373775ea9a46190d0222589e12

  • SHA1

    36309ca5cd96eac36673798f1dc81eef5df36ae6

  • SHA256

    b250877cdcc29acd15fff50564c19af7e22e0a6b096c095a8773e2649047dba2

  • SHA512

    9949612645094dfb26336cc5c7968ea22b3c4eb27d29b634ed5274cf9499ef08aba35bad7ca2fc2f711a2e48273b25558d561bb28cad70f7bd0317b2146cc7ab

  • SSDEEP

    24576:3HtRvSoL4b4EH+3zD3VVuPEkCJ/ZSavL1uEzz1ZE4hwT2P/IQWit3zRfhJ9d:3v5sT+9VVVFcgLDNi4hwT2PhWyzRHP

  Score

  10^/10

  stealclevadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2