Extracted

• • Target

    7ab0aa98af77e31460285b0a3039640c10f1e4209166c698fbd02ed84e93e131

  • Size

    2.8MB

  • MD5

    176ef761a0d2ce28e3e2a3013eefa8e5

  • SHA1

    9dcad1b3ccbe31d12f6b2ae8c7fabd3be5fa9c90

  • SHA256

    7ab0aa98af77e31460285b0a3039640c10f1e4209166c698fbd02ed84e93e131

  • SHA512

    5a2880f3a6e41e80e054a10023a915ada443be0a8a7cb86ccd238eedd3c8998d7c8f3e1c657502e0d4c0e3900e63ff12b17d80fe5437d849b66f2ec65d28ac54

  • SSDEEP

    49152:qqYVg81KGDnvpfm6N+h1SWgdfMVCQpPlskCgVkOe:gRBDnxfm6NYMWAMVCQp9GgKOe

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2