Extracted

• • Target

    78de9ce3dcd886ff274eb87778c91b09f79aae306fb2bbd10a2c1d03f7b96775

  • Size

    5.1MB

  • MD5

    78bf411a2841709518fcf61bdb6f28c4

  • SHA1

    f25f9d8981de08195d31206e5cb6bdca83fea1da

  • SHA256

    78de9ce3dcd886ff274eb87778c91b09f79aae306fb2bbd10a2c1d03f7b96775

  • SHA512

    65c60bd5aaa1fb3541696b1546940cf30acfb8b2e6e969cb40f6af53de75b3d6adfb93c2a4036e118e2c04644a0ec88b213906b0fbcace9d30b23a7ecb2a03a3

  • SSDEEP

    98304:q2iy0EsVgcSIau5dSZVzGHAfZl2H0igD21AWsNJzX5TpzD6Pge75:h0EPIaFPGHS2WqIxrzD6D75

  Score

  10^/10

  stealclogsdillerdiscoveryevasionstealertrojan

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2