Extracted

• • Target

    f24b027a6dc08e0fee6915f49a315876ab00531dc019166f38ba9bcea471a6e1

  • Size

    1.7MB

  • MD5

    fc9e644c174f1db125a851cff88bb243

  • SHA1

    b9450cc4e71c8b927b34d48a7e83f2f9ffb1794c

  • SHA256

    f24b027a6dc08e0fee6915f49a315876ab00531dc019166f38ba9bcea471a6e1

  • SHA512

    bf9d2d6d729fd8949d1064ae11bb2caa0da428b84ae2960eab4813a3523f6b518c93b36a7ce00482bce3b69a4d428a672f63b2acdea8e74fb9248b9e39266230

  • SSDEEP

    49152:+R7luH+TFw9gj2cDY1xeJr+3FSKQBisQ73i3mBOhi5n:0TTI2CxtF+Bg73smw4

  Score

  10^/10

  stealcrenodefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2