Extracted

• • Target

    ac26e3ac8e117429b3f25ff51ab53fb9ba45f0597775b7a97f22daac0bd21eb0

  • Size

    1.7MB

  • MD5

    6537cbc9ec47c9944d2ccb338697a23f

  • SHA1

    e1dda217af278eeca5cf27bce2832646f99b2f56

  • SHA256

    ac26e3ac8e117429b3f25ff51ab53fb9ba45f0597775b7a97f22daac0bd21eb0

  • SHA512

    cf0cbb602781bd781962c0d520307952dafd8b845064d8a2c8aa6cfa54b7b5c5bfc6241cc7012d47db13a61384b050677d372ebaeed697322622d321632f7438

  • SSDEEP

    24576:7uhjqdUTWeG1CQvxmTBeKt9zk6DY7FDDis50OR9aGsqVEHIj4rFGemgDjnVGj:6hjm/eG1zxi4Kt9zlwDMORFq4OjQ

  Score

  10^/10

  stealclevadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2