Extracted

• • Target

    c88a778bbc27987aaa0f0ed646afccd7601102adad31cb45daf382f6c165d371

  • Size

    1.7MB

  • MD5

    b86acd446f0cdc8f7c2ef87545f5ea0d

  • SHA1

    f4d2ffba82a0e72e18ad80a0b2c858bcb2aa2197

  • SHA256

    c88a778bbc27987aaa0f0ed646afccd7601102adad31cb45daf382f6c165d371

  • SHA512

    6d00ce1814b1a0a9ce3e4f2be42e86be94bfb3fdfe0a1e62e02dd0db6275990f90461ed37b93e86bc2b6ef26774058e5353199848b7e16fd001aae04cc8dc717

  • SSDEEP

    49152:v+7yfYe+CZCng9GI+0f+MYyrrp1R2174LY:v+UYeEg9G4f+fy7l8

  Score

  10^/10

  stealcstokdefense_evasionstealerdiscovery

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2