Extracted

• • Target

    eb9e0ab7722a28e6c8e797d66593cb11b544ec242c245f9d8d924b255ed539ba

  • Size

    1.8MB

  • MD5

    bb02eb5eef47a773ae26d60ae263d9fa

  • SHA1

    283211e861760787a349aefc7b393f41bd00dda6

  • SHA256

    eb9e0ab7722a28e6c8e797d66593cb11b544ec242c245f9d8d924b255ed539ba

  • SHA512

    5868e829d7bbb1e3f208631c9b31c93faabc9cb9e197b814364c91459a4d6fd2b84de19552bd36950878c5b54224c1e2cb35c181d9b4115a848386836e140818

  • SSDEEP

    49152:OmUX0sN3d975CMhF30enXmRRKku6pVf28ax7ZjME55:HUrN7JFnnXqRK8po8ax7xj

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2