Extracted

• • Target

    f39939dcad900de2de347f7c0e4bf59c0d734b792082c34c70dd095ffffd3221

  • Size

    1.7MB

  • MD5

    7c941a06afbf58edcc99712e9007be9b

  • SHA1

    4b811986fa63d758a8c6dd2018284e99995ab662

  • SHA256

    f39939dcad900de2de347f7c0e4bf59c0d734b792082c34c70dd095ffffd3221

  • SHA512

    7698178dfa9b779376e413dc6f7bb34bb9c25481b1bf575e98390d379478727c3446f2c663943b69a4111001bb4269af998aebcfc5a70f6e64d075e032523100

  • SSDEEP

    24576:ebADNhkztqlIbUk/CuQebUs+2Rm+SdO71VZkS4S9GxISOMwOt6mEwQHCQoCn5ZxE:1bCtMgUV2RvxVZkSDcOMZt6FwUbx

  Score

  10^/10

  stealcmarsdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2