Extracted

• • Target

    17ee09d8a9c80e91d68ad11fb51a10d21f6debbc7793d6e04e3a9cf0bf4ac3a3

  • Size

    1.7MB

  • MD5

    52ac46f22b9a5c1fd795f96040c152fa

  • SHA1

    3836fb7fb5fcfc0aca64ea7eb131599d5015069a

  • SHA256

    17ee09d8a9c80e91d68ad11fb51a10d21f6debbc7793d6e04e3a9cf0bf4ac3a3

  • SHA512

    47f59e96ac63a752299caccde0cafd6c984d9262d8a642f775d177b53ee47cb5224ad103be4328f5242dd2d8182f8652c8e83025ba567797e18e530022b21b60

  • SSDEEP

    49152:4L/tze/tz0Ys2mvbI8SNtynkiySBmaCBR3ZnLfGlFVm5WF:ei0YbySb0yo3uNZSnVmAF

  Score

  10^/10

  stealcstokdefense_evasionstealerdiscovery

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2