Extracted

• • Target

    c7107e5b4a7a6a36e7d841c528056fc8748e4350ec6b3824be7b7b45e3778676

  • Size

    5.0MB

  • MD5

    de1d6ba5a3d41a8fa2d97694efcc0a5d

  • SHA1

    234a176f9f778db7a8639f7450289d426421e324

  • SHA256

    c7107e5b4a7a6a36e7d841c528056fc8748e4350ec6b3824be7b7b45e3778676

  • SHA512

    c4bfc293f58fdbaaf081ba91f2303d7ad7505faecd49200187f1ab94f9c79b6d95a570cb673fd97762919d622e2def3dd513aa71576e00b2b898362503d1d502

  • SSDEEP

    49152:68cvcusKwUPK4N5MQ+2+e9jbb5gyczD+iZ:63vcusKwUPK4N5MQ+1eJH5gbzqi

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2