Extracted

• • Target
    c4c0310bc779bb4ba051be5fe124c783a101e9d0ba03e530292e69ab00cd9cea.exe
  • Size 1.7MB
  • SHA256 c4c0310bc779bb4ba051be5fe124c783a101e9d0ba03e530292e69ab00cd9cea
  • MD5 bd034ca154769f1df2a8ceb60c204380
  • SHA1 d8d6680f9cc9728124785426422863e11804bad2
  • SHA512 c128f3ba3fe425ea35fc7a20d1f19e8c8f946155f1d14f63d8a8234a1508cc5d7c9926581aa516d9f04e79bdcb625533baf5d7ec0e125d3d1beb4d75d1976bc9
  • SSDEEP 49152:WiGjOhbTN00JS3M/Hk7C7x1LckfvGYrkQ9E:Wi5fS3M/Hk7CXLc2GYwQG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcdefaultdiscoveryevasionspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2