Extracted

• • Target

    dee256c3e58e4733609a4dad971c8c868ba1c833a1fd9b97fc0335b0c5c2b839

  • Size

    2.1MB

  • MD5

    78bde34f1c631d62b7b03724cb7d3ac8

  • SHA1

    87cdac6de92bdce5681d3a6a2ac7c560b8652878

  • SHA256

    dee256c3e58e4733609a4dad971c8c868ba1c833a1fd9b97fc0335b0c5c2b839

  • SHA512

    04a701ee459cf3b61224f947ce4e45f80120566ae8c4e88aa56f965381d8cc7ec65bfec685ddf5c003108cea8e413bbcaff881c43c8c3162833daf9a86a07752

  • SSDEEP

    49152:TJ3ZpIy0ydiSNme/Bmc1mBMeUdpMXPMYrME8G0:mkiSAep/1mKq/MYIbG

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2