Extracted

• • Target

    6043008c11c8b5b5d2658e8152ba59573fb7ec7d52b04082a78987eafc62fa50

  • Size

    1.7MB

  • MD5

    b6e098e22fd89874d350adb5ad1838f5

  • SHA1

    338a10281a73ed3f7cfec70c8661912d0eaaa7c8

  • SHA256

    6043008c11c8b5b5d2658e8152ba59573fb7ec7d52b04082a78987eafc62fa50

  • SHA512

    72bd300ed53b8c207d62302852ead0d8b9c045f36805f04f62d816d626c50725afe72916abcc9b1f3277a4c63eb8e87694f6bcc722b47669c8409038a645e68d

  • SSDEEP

    49152:JeeDjriXN2Qfd480keWYyX6FbJHhfSZ25GqbmBc:JeeDvid2QVmkeWYSQ9HhfSGN

  Score

  10^/10

  stealcstokdefense_evasionstealerdiscovery

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2