Extracted

• • Target

    a97cdfe7dbec16d938a69ae8232ac566ec78c77b6894d6eaee85e849a3d09303

  • Size

    1.7MB

  • MD5

    fec895267cbbeefdd29f21400a916f53

  • SHA1

    f4061ad426897d6c3f238dc9b7fb37879fb253df

  • SHA256

    a97cdfe7dbec16d938a69ae8232ac566ec78c77b6894d6eaee85e849a3d09303

  • SHA512

    52dadf4ee472b838816abe9675bb8c58f15ab3013fce0a5fc4ddcdd3597dbfbf22b3db9e922a1d2775c20d2f58a8abc98559f6324d04adcaecf3c02deb44eee1

  • SSDEEP

    49152:0nowhaRIEXaQ/RWGcOc+UtaEIWuGhI31eBP:0ZWnPBpUhu+IgBP

  Score

  10^/10

  stealcstokdefense_evasionstealerdiscovery

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2