Extracted

• • Target

    a6d5d4d87e699c5fd4b6b07b92800896e2563e9284a4182d6bbce7e3a93dba90

  • Size

    1.8MB

  • MD5

    5365c8f512b63c01a6283ad7b1fb2f86

  • SHA1

    0c8a2d5737c619f8753bd0a6facf80f4b4596dd2

  • SHA256

    a6d5d4d87e699c5fd4b6b07b92800896e2563e9284a4182d6bbce7e3a93dba90

  • SHA512

    900aa46205c0a7733f0a2f40d853c1837d77162137cd841d641b8c5ea97cf39b48883b36dce26be0d3bcb5c0e930e07be59252d6b9e410dedc32a2495e7b3183

  • SSDEEP

    49152:GwLMhIrAdG5xHR2xzAWyX+sDpDTnfsHq2e:GwoyrE6xx2cFDpD4K2e

  Score

  10^/10

  stealcrenodefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2