Extracted

• • Target

    c1bff63e4e1aa1fccb42244c12ef8db8ebc4e0e3a1339f58e3801ee9f8e7ef48

  • Size

    2.1MB

  • MD5

    686c6902c3cea93c353dfb5532d73013

  • SHA1

    760cd9a27a11acef4b009381206e5788b539d680

  • SHA256

    c1bff63e4e1aa1fccb42244c12ef8db8ebc4e0e3a1339f58e3801ee9f8e7ef48

  • SHA512

    d7aa28fa9fd142d76e95d386a8c68aff2c258e2063c442308bd53ea38c6956ee988b55e5453f8f08c6be4901ee6943e90bb745ce1ac8a1c5bab2a2462d56f119

  • SSDEEP

    49152:paS9i86GfORLZTkRaVZ+m1CW4exRVO1moW:10PG2z+m1P4exDOY

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2