Extracted

• • Target

    f87a85680eb816889bbefe15af11a68930eb67ef6904dc7201edafdddf1a1bb8

  • Size

    2.8MB

  • MD5

    ad87440d4b97e759f9d4ee9d6279d06e

  • SHA1

    7525695152b7c233eb6eb473cb8ed54e476b28be

  • SHA256

    f87a85680eb816889bbefe15af11a68930eb67ef6904dc7201edafdddf1a1bb8

  • SHA512

    f1d97bc33000ce39dd207b7c824cd4b84581055831c98e72d9f3facfba1766c90aa3921d96cf486c083526c4062bd3bd66818d74cf4142ded32c878ac30ab903

  • SSDEEP

    49152:dUKOFohGWJqh/PVWikBefgLsJ/UtQneLgNfP/TTi:dUKOFohGWJinVzk2oKneLgl/a

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2