Extracted

• • Target

    4f44e4b67a801c3f7b7fa68686f15a95320359c58da0165aa9656da24cfbb8e0

  • Size

    2.1MB

  • MD5

    7f84651d5fba58c9c924ac13bb46a91b

  • SHA1

    cd2b927fcc75f51d58e56e43b742017e90b8012c

  • SHA256

    4f44e4b67a801c3f7b7fa68686f15a95320359c58da0165aa9656da24cfbb8e0

  • SHA512

    35e59fa1824af6297297a8dd9cf6456e9ea0ac9c1a6d9797ecae127960cbffbb41e77bd8ed4c8127594b8aba2448815fc6eb86b315053c61697cb9f5b50c23cd

  • SSDEEP

    49152:1EV5zfr0Wm/+V5uzaioHxzkG8zyzUc02uU9:+zTWG8TQBwyzUc0TU

  Score

  10^/10

  stealctalecredential_accessdiscoveryevasionspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2