Extracted

• • Target

    d12f2ae01dcb1dcbe9d1b5d770e98598e224700ea44cff16501aa9276ea80c24

  • Size

    1.7MB

  • MD5

    0419ec2c97b9b3be4f843b685dc437dc

  • SHA1

    513b6b17b295588536405eeb97ec7c1109957a75

  • SHA256

    d12f2ae01dcb1dcbe9d1b5d770e98598e224700ea44cff16501aa9276ea80c24

  • SHA512

    9c4d102439891f0a4cc1e900fe05af2abd38bf0422bfe9afd0102971029411982407a432db5cf511ed7af836fdcbe2973e8e01a3a2b95c2d8162730a02d98473

  • SSDEEP

    49152:CP4Otg5uy4GstHiROeye12ezRyBplbDDT:y8z4GstHiRbye3u

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2