Extracted

• • Target

    38300f513b13136da06d17928459a4a6daa64e5cc7a6ca3db1cc73e48222808d

  • Size

    4.9MB

  • MD5

    918e4d1abf21f088a94746a2f17768ec

  • SHA1

    a1684d7b99be71ae852a9cab4978d98506c9166b

  • SHA256

    38300f513b13136da06d17928459a4a6daa64e5cc7a6ca3db1cc73e48222808d

  • SHA512

    be471f8fc4aaff9349a764ce3766d979c5c706b5528d0ce8aa82f3970ede0bede292253203e720caa578cc019aea60ec5ce1acf147091f0f00aac25e6e3d682f

  • SSDEEP

    49152:hKUB1fmtN7YQhLqSPM7xvNfhCmKRr+fBGbIfvyM:hNPmtN7YQhLqSPsxvNfh9KRafBGbsy

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2