Extracted

• • Target

    7caa7d434f74af2f1d07cd0162f6a41cdbe075ce3a91bf16c6bf0a6afa654f28

  • Size

    1.7MB

  • MD5

    9373da7e216a146ab41c7d93832b138d

  • SHA1

    78bac9a76b487675cf4697822ddfe9db058d2bc9

  • SHA256

    7caa7d434f74af2f1d07cd0162f6a41cdbe075ce3a91bf16c6bf0a6afa654f28

  • SHA512

    7941f2915f8c5c6f61e45f25eb8258e794755234bff3b7093c3727aaa82bb04ffb8b9bd4a5251427e1be5efd3aa98023275f5a97839cda7b0f6e9bd09a3b5bb3

  • SSDEEP

    49152:Y/RN3Dc/NmddfCyP+fRkU3aOsAIFdTKmfvw:WTc/QOoMZ3psAMZKmg

  Score

  10^/10

  stealcstokdefense_evasionstealerdiscovery

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2