Extracted

• • Target

    2402746c25bd727ed3aaf74de34e4125a0bee60788673b02b98b87aca157b778

  • Size

    2.8MB

  • MD5

    50ac31ca3622476b9bb8bf58f573aca4

  • SHA1

    069ca3c71c9f51f38946f53ffcae2f40e8fbccea

  • SHA256

    2402746c25bd727ed3aaf74de34e4125a0bee60788673b02b98b87aca157b778

  • SHA512

    dc81d2239617836cd2cd49c008590209584392ed308b99c795ba27f63d55f2e73de8a15500ca66d50b9a1b50519013d43b9937b7f59aad4b31382a4b9578ac9c

  • SSDEEP

    49152:lXAUm4JYY/H3MwfkaZ/e4ir50NMT99/ol1cMmDz/hcD6W/:ZAUm4JYY/8wcaZG4ir50GTCpmk/

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2