Extracted

• • Target

    b4dd4f0bce4d55f063554bb26c42b7739f91b9d0ef09282f16bd172386155096

  • Size

    1.7MB

  • MD5

    04f1a1d45f9e3a416c8cd3dc2c0c3ed9

  • SHA1

    dc9c3e544b2ce4adcae422ff12d57843144b4ef4

  • SHA256

    b4dd4f0bce4d55f063554bb26c42b7739f91b9d0ef09282f16bd172386155096

  • SHA512

    60f884b1ff9333c115e363b3793a42345f42bd51e372e778345db9dd5ad7d5497bea201269709641da30a1c3e15dff4c60065e287512caebcdf0aeb112a68d1c

  • SSDEEP

    49152:m5o5RIWuzcJ3sFno9uhMrX0f++UqB9U81de9AfE:moRIWuzc01hkE++FBldU

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2