Extracted

• • Target

    7cf831e262ee58828e8ddb45f2d56f5d20aae4d20c2a3cbd4b13e4fc0fc8c88a

  • Size

    2.0MB

  • MD5

    e16e8a63dd2f418818c89f7afa98a828

  • SHA1

    2a2871bc83e603e994429ab08f2444fdc67245f9

  • SHA256

    7cf831e262ee58828e8ddb45f2d56f5d20aae4d20c2a3cbd4b13e4fc0fc8c88a

  • SHA512

    e9fd477359cfceb6f9e9f136af44ad94817fb2207fc3b881224a9721333364e68eda6e963c76bd7fc69e0eceaf3c6358f270efd889d629fae9f436a029d6337e

  • SSDEEP

    49152:pLMltH8SypoL4zgvAei9bCXoLQ/i6wot:xEHOoEz8Y9bCXoLZPU

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2