Extracted

• • Target

    81ac77037e15e56a6cdc0ba7e2af38e3e5a9f7a353054276c763e57d03db5ec1

  • Size

    1.7MB

  • MD5

    1e95dc10fef7079a5d3fa793732a7cce

  • SHA1

    8e9ccb511e76c921c6ddf2a2615a2e3c86ea4113

  • SHA256

    81ac77037e15e56a6cdc0ba7e2af38e3e5a9f7a353054276c763e57d03db5ec1

  • SHA512

    c35cb0cc0cc9046acab79fc70e26c28fa32f86e79dc36d44f938efada6bd45b190746d6f966552aa3eba45967b7f3ba7e113d8593576b7bb7f7fcaf670a23773

  • SSDEEP

    49152:QShNR7nL8ZBF9CuDe7VL4a1PzDaisxBU0Su1bJX+:HR74ZoMeJL4aZXai+BxSu1l

  Score

  10^/10

  stealcrenodefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2