Extracted

• • Target

    2603c54e77988004446d41f64a45cf88f0917739e23439a0fdf879784acd6304

  • Size

    2.6MB

  • MD5

    020c31437d986a6d83ae83c09a2e4887

  • SHA1

    add0b44fd39a043e659cee280a5acbf6a22f5c44

  • SHA256

    2603c54e77988004446d41f64a45cf88f0917739e23439a0fdf879784acd6304

  • SHA512

    8ad05463d1cebdbf8e1765d7c8c26df273f25d06654b1efe67997eb0930e6fe1e03e1d3ac0fd5d4ecfd07753f98e0b0b6dd2ae50d2dbe156a85def5ddd2aadec

  • SSDEEP

    49152:76MKZD8x8gOdUVC+XQigB+Yj+gwcSSN8qxaGg1YD:X9GrUVC+XQtBNxVgiD

  Score

  10^/10

  stealcravediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2