Extracted

• • Target

    b677cf42388939a0d9cbe0d2d832708eff4b2855f98fa584d879884c52c51a26

  • Size

    5.0MB

  • MD5

    c0628720a50269e551a2d5ae55ab558b

  • SHA1

    a56cbafdab74385d917a70ff82d0e2f0923bf78f

  • SHA256

    b677cf42388939a0d9cbe0d2d832708eff4b2855f98fa584d879884c52c51a26

  • SHA512

    67898f886aa03d2a5852696477db606e9c2d17fb8ff121b4481f73f95b28885269f305974fa237f777e80e2d6ddd8cf254f6f838adc2baf7c363fb81cd9ba5cc

  • SSDEEP

    49152:RLImNoTxmPfJmD3X+4mNbdo1ZZU38tY1uHzm:9IqolmPfJmDH+4mNRo1Zg1o

  Score

  10^/10

  stealcstokdefense_evasionstealerdiscovery

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2