Extracted

• • Target

    47bd6c06b3c3bd948e206fc5491ae477230eee08b7116adb0e1fe5b250fd8ca1

  • Size

    1.7MB

  • MD5

    819deb65fd6886d842909e74a73b8ad2

  • SHA1

    a81c45767a6107fabc316bc5bc4d530ced9d75f0

  • SHA256

    47bd6c06b3c3bd948e206fc5491ae477230eee08b7116adb0e1fe5b250fd8ca1

  • SHA512

    239e450446e5d1c7e4b802cbd5514a6d0d395b2813cbf9ac80b4e9bf2ed70f5de351f3bd2d25e71bb1b7af4632063fb926b48750332f11dc3b650927998d3ee1

  • SSDEEP

    49152:jSMdgXO2flpsSmW4EHYEZFs9LI/6fFyYg/1lL:jiO4bsSmWVZFQs6L

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2