Extracted

• • Target

    0e5122fd9b227a8aee3dc4418f1bee6301fe29e5bca2593c22c13797736fe02c

  • Size

    1.7MB

  • MD5

    d6182e568cc9e863b6f14ada12b32c7f

  • SHA1

    1b7940cb1639b6802db444c6792875751a6beca4

  • SHA256

    0e5122fd9b227a8aee3dc4418f1bee6301fe29e5bca2593c22c13797736fe02c

  • SHA512

    61bb8606e23f98e3e7ad18323feb1e54ba6e6d1824d58567bc46a3e39d984ef7b6a405a841f3d19f223eb01229839d05b1f5099ebbf72a14f861a03e2b692234

  • SSDEEP

    49152:wt+Xl0fUcbYikRMtzBCRgcARj8kdS/E4HlLT:C+10ffYRRMtzoRIS5Hl

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2