Extracted

• • Target

    0c068f3dfe34b309b11826e7682806bd0721d72fe280acff25a9cef89241248f

  • Size

    1.8MB

  • MD5

    23d888cc2a2d65b6170447374d5fd689

  • SHA1

    06b7b7235ef9f833e6b6a94a69ca181bcf0b18cb

  • SHA256

    0c068f3dfe34b309b11826e7682806bd0721d72fe280acff25a9cef89241248f

  • SHA512

    2a0f2b43de50373c0d5c0d3b079e5195629078f3cf047b48905bd32a2015ca62cd048a568a3dd3d56967d6f8841550de535513bd3e18f03c84538f27ba3f43c9

  • SSDEEP

    49152:wqYDVeRz79eG5WudsCzDzeuhRxZP0lP2gx+d:w3DazpvF7zDzeo/GlPz8

  Score

  10^/10

  stealcrenodefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2