Extracted

• • Target

    27c65d300795e161913efedf9861aa1f9dc760d869d35e21b71d9c90c98337e3

  • Size

    1.7MB

  • MD5

    adf1ab607064ad30fcb2cd34dbb36505

  • SHA1

    b393ffaaf0b4e361ee96ad11bc9d4a1edff6d8be

  • SHA256

    27c65d300795e161913efedf9861aa1f9dc760d869d35e21b71d9c90c98337e3

  • SHA512

    87cd57f0dab8ed612219ce87a4a59bac908c451f3f7d858705d5f8c179d8a33e78303a66d9b222f5a6dbf15656d4264606453b30b567eda53dade3f315a5f992

  • SSDEEP

    49152:WsIBUdbL6K4wQANLrlalHwyuIxT0Kh+tAWM:WsIBkbUNAxrMlHQIpKtE

  Score

  10^/10

  stealcrenodefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2