Extracted

• • Target

    1dd04b677a8e124c336a3bb427cae263a81f692d8b5d2e0f5d33360de2763316

  • Size

    2.0MB

  • MD5

    a787d0a91b5362989ce71013388683e5

  • SHA1

    f962241a7392018016bbdbbc2c4f853ceb8f4a3a

  • SHA256

    1dd04b677a8e124c336a3bb427cae263a81f692d8b5d2e0f5d33360de2763316

  • SHA512

    9357a525424ec4a96a375418c9730e5fa0cc3d81c626c85c381085cfe4e8a5ed985ec2a3a4d36d4929f6dfe59484bfa8165b2aa245a99fa8def0677acaf4ddf4

  • SSDEEP

    49152:z0xl1u1chKwuPDjJXAKrtsyOf1G25Wxo4cC:gRu140dnpW0KIc

  Score

  10^/10

  stealctalecredential_accessdiscoveryevasionspywarestealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2