Extracted

• • Target

    156eba27915138b3b70cf72a6d478696b6bf2047f18e633cea27b5f499c96b12

  • Size

    2.0MB

  • MD5

    240f8d86f2944d328bb9114faba27da6

  • SHA1

    69aa2bb22773ff4ed93f0124fd5d3b6954399b70

  • SHA256

    156eba27915138b3b70cf72a6d478696b6bf2047f18e633cea27b5f499c96b12

  • SHA512

    55dd2d2d2445baf7d19a6b1d296e02789a0f263dd78f1e58715ffe8801320ba54b0559f4f59597498ad876a1bdf0537c3f73616e8ca64dd4b6a99882d40c8835

  • SSDEEP

    49152:S+b7vTkIpaBDB/J/k2luVnY77P/hwUave8a2GS4GJFHl:V7vTkIIBBzwnY7S5a2GDMB

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2