Extracted

• • Target

    beda49bfe82dcbd8a63c66c3e7840919e0e8b883d5330e91e066c61a518a1ab9

  • Size

    2.0MB

  • MD5

    8c30a3972e4d5600e96c86b3d1eb906e

  • SHA1

    ad45d77307b96655da9caa9147e1cfc7c7bb0015

  • SHA256

    beda49bfe82dcbd8a63c66c3e7840919e0e8b883d5330e91e066c61a518a1ab9

  • SHA512

    9b1764a9728e31e27dd6f8bf96fb12e0d0b4bead286e4310eb8ee3a3ffe2a7b43a5d6fe102b908cb0d273c09441d467e3f0d632e600bebdf5c97881fe6fee596

  • SSDEEP

    49152:n2ryuQDupSO3KAkgz+pYHDVczV/01fUc6ePcPge:2rUBpAkg24GR/YUa6

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2