Extracted

• • Target

    49911732f38d682da9361e89023ad01d31d677a3011533b23e8a9ae6a7dfc149

  • Size

    1.7MB

  • MD5

    55e004e4ac047f9261b6d743eae2d2bc

  • SHA1

    221872c16821c76a8fe37411df5e3d58f2c31061

  • SHA256

    49911732f38d682da9361e89023ad01d31d677a3011533b23e8a9ae6a7dfc149

  • SHA512

    1bbdaa2e6e4bc633a857b36a4b6e7d8c536cc51bae377233e95383c65f30dd33e213cff51509dc741bb37f6a1841a84ffc9d9e2d33e8f4b5c53fc049772092f0

  • SSDEEP

    49152:EIyOyp7b77UXHswPvIiJwOSBMBYDzhSc9X:fyOy9XQsNg+ca

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2