Extracted

• • Target

    1f991fedca06e5fb34e95c1f28ef49e7a13be07ca58312bdd1b1be1791bb23db

  • Size

    1.7MB

  • MD5

    bef57112e098b157881a06a653b91b1d

  • SHA1

    dc1efb36dc01e2392d6bcc8e38a6977d1449a096

  • SHA256

    1f991fedca06e5fb34e95c1f28ef49e7a13be07ca58312bdd1b1be1791bb23db

  • SHA512

    161a383985aa9eaa87b9ff3f82cb7864649b937f696bd50940e90a5f613165b8487f8d0a81a36928a6887f5464abcf4fd4624173614536953b94486197413a52

  • SSDEEP

    49152:k9RtRaANqqWcVHp/Wh/v9XohCbPtA5q1T:UXUWWk/WhVoYZZ

  Score

  10^/10

  stealcstokdefense_evasionstealerdiscovery

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2