Extracted

• • Target

    c62fd06fb157e3a4ddf3532be110f88ee8fc51becd47f9e20e310eecda7f12df

  • Size

    2.8MB

  • MD5

    604967451394740aaf0303923e2593b2

  • SHA1

    813bee19e6129aba4bfe24d4e73edb0730c12cf9

  • SHA256

    c62fd06fb157e3a4ddf3532be110f88ee8fc51becd47f9e20e310eecda7f12df

  • SHA512

    3aa6e6ebbff77482a25985d4b05a3103637cce4c525a1aeeae33e68f2ded76dbea6bf8ca0775179a52162496ad6111cf496392fe2547b909cf9d234be6383c6c

  • SSDEEP

    49152:/B19Pwsv5S3InbHJlSfI59toScFpV3mSbGp1SsPxMtL:/B19PwsBS4brBho5pUcCSGx+L

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2