Extracted

• • Target

    2165984f24da970fd8c1f200ac75471d151cae8409cb20787d2e98e9fc4e102c

  • Size

    1.7MB

  • MD5

    ffe913df5ffe48d6e73f144bb3b730e9

  • SHA1

    259da8a5b27c1d32f345936873213e7a7edd08bc

  • SHA256

    2165984f24da970fd8c1f200ac75471d151cae8409cb20787d2e98e9fc4e102c

  • SHA512

    3aa41d0357c561dba73f90f68912f1e1ad4fc65530307f14e6ed3b7ec502977db06aeb8b8095aae2865cba43cf78c87d36c21e218d01131206754fd72b3c5a26

  • SSDEEP

    49152:hEzAqNRNnLIfb63/1xES4Kui6Xor3SVmeHCc:hEzAqJt/bE0uiaomVPC

  Score

  10^/10

  stealcrenodefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2