Extracted

• • Target

    6b54559b4d5c5e0413800f434d2fc29409020ad60ba08e65f6df117907e651ae

  • Size

    2.1MB

  • MD5

    fffdaffb81d0e752ae14ba04b8b6064f

  • SHA1

    3056c80dfded82c41b439c8344f6aa62c745398c

  • SHA256

    6b54559b4d5c5e0413800f434d2fc29409020ad60ba08e65f6df117907e651ae

  • SHA512

    af6f7054117ee499a835100c2c9b069b4e036db9f271fba6e44c749346b515470362086aef59b4f56d1e7fb988eda6db55c7360a702a343e1564afdec66ff112

  • SSDEEP

    49152:W8cpBUJyZvF9sB3vQhcw91xvHeQDZxQN3KTIvl54A/KjvLN+WZEdy:spngohcw5HeQVaF/4A/evZRW

  Score

  10^/10

  stealctalediscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2