Extracted

• • Target

    6f522eff93b41e3abe50bca8df761fd0e6313117578f3abc7e3f348eaebdabc3

  • Size

    1.8MB

  • MD5

    73d405f0df578e1ed00dfeba1b9c5a93

  • SHA1

    37b57abf91513bc85b27e4c4ae85b75ff87898e1

  • SHA256

    6f522eff93b41e3abe50bca8df761fd0e6313117578f3abc7e3f348eaebdabc3

  • SHA512

    5b2b66e9cc75ca7d0322b6af3b4f6b9c54034de22f9a06372e5acae0aec6761be01ef6b6877619963dc5771f9063ab3648c8db390945a9db0e9503f66d9eba74

  • SSDEEP

    49152:pPEgUnW76fFOTw0OtHWefWFtSQfPklw+nE:pPWn/fFAU2eOnSQfclTn

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2