Extracted

• • Target
    file.exe
  • Size 1.8MB
  • SHA256 2202c6a6673d6a90682946b94edfc8c6bac495997e064c62b36bc0f046457a51
  • MD5 fe2148029209699e0ee2cba27c4d5f8b
  • SHA1 4c9a256eedfa50b45b488e01c656bd72ddec016d
  • SHA512 3d933415de68bd2d15e3d69d4e095aef5d6614d1fde26aa83f97b5788f7282912bbd9dc943572ec0f29a9e6946cc30dbe6647841cc8a715093c011997c81343f
  • SSDEEP 24576:6Yv8pzmkm89otFC6WlLfDlV6TDRw9LxaYUKMatOLZLXj5qdy7GQPc/LSCcMFIpF5:6lzzfSFC6wbZmNkLxaYllsFOamcFd
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  stealcdomacredential_accessdiscoveryevasionspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2