Extracted

• • Target

    6b0e96c1acb41e4f49a6632bb02887cc116377598654e5815e3a99592bcaf9e0

  • Size

    2.7MB

  • MD5

    8b06fac3f25efc2c2c21b97727b7afec

  • SHA1

    210a1e3a210391ba6fe98e1913ab2fc70abf2c09

  • SHA256

    6b0e96c1acb41e4f49a6632bb02887cc116377598654e5815e3a99592bcaf9e0

  • SHA512

    7aeda0b6cdf41eb38d6ec1fb3c4492427330f459e71e057d15fc075b584f04342b12af0d6711cc8583fd4067aa49dfb7646950d18e2d6171e07e329df5700cff

  • SSDEEP

    49152:JM989Dj1Fb/Tmwm6SVSd4lEfjLatnvwwMJ4tVc:JMG9DzrTmwtSVS2WHaFMi

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2