Extracted

• • Target

    f0947eaff9837140af164952d5ff422e3f9e35cea5c85a67709fb97638d03f12

  • Size

    1.7MB

  • MD5

    b914f31b2599675cb8a7ac4c9262ecd8

  • SHA1

    00823733cca7494e9eab8683b24cceef06b9fb8e

  • SHA256

    f0947eaff9837140af164952d5ff422e3f9e35cea5c85a67709fb97638d03f12

  • SHA512

    ce490f5a9ef7b23ae352eb735b53846a1a07272de7f291e63d464fda61a26b771bab063214e5ea007dd83b4a5fa16b7248ff01b39da43d95989d724625f96d57

  • SSDEEP

    49152:2uusp5JHXxIG5Fu8ixkzSEjoqWikq1j8m:eEJ3xIG7u8pzxo/

  Score

  10^/10

  stealclevadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2