Extracted

• • Target

    4040e6d92b7ed3750f7518e59eb9ad2f505f8a498784f530b6c8c81bef596c53

  • Size

    1.7MB

  • MD5

    14be7508fdd7ae331473b734cd714c0a

  • SHA1

    c6dd07e77e7772698771fbedcc1b9165bfd2a539

  • SHA256

    4040e6d92b7ed3750f7518e59eb9ad2f505f8a498784f530b6c8c81bef596c53

  • SHA512

    362916513e2f4d329e1fb5261d3d9f4b3732dd9ae3fdbdfafb5a86bcffa8caccee12f38b5ed5998b78a3e7b0e6492f5621d26224ed26a5444422cb281d9a80e0

  • SSDEEP

    49152:iP8CP09ZhBNG1DE4dKO2QFrSFOS3ZY5/timbey:qnPWWVhdKOnKlJY5/tiQey

  Score

  10^/10

  stealcrenodefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2