Extracted

• • Target

    file

  • Size

    1.7MB

  • MD5

    d8660a1ff68fffceabf3ff698d4f9ab0

  • SHA1

    7cd164b54c7ce33bac8cba33500d22b8d1e257a0

  • SHA256

    3c7f771ea8acf8b9e55967eeb251fbad52462e0b34a2e64a5d524f02fb377c66

  • SHA512

    554e805a52b7651a6c34872bea9d758ca165952f6f9844202446dac0d40aab4c39723f694980234414e67cddb3831d4744bf66b7ac3470da571ba18e0f1cade3

  • SSDEEP

    49152:s/MSEKSlyjMV4KJRRgsEpsB9j+teSfQOQk:skS+RgFiufQL

  Score

  10^/10

  stealcdomadiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2