Extracted

• • Target

    06719723b85c40ec97d49a498ae0eccc537df6f2663eabbb58cb2bfd52f1503b

  • Size

    2.7MB

  • MD5

    198c34c639aabe94b184910b7c000d49

  • SHA1

    74406b01f739c9442ba085cc46dcfd85ae661b1d

  • SHA256

    06719723b85c40ec97d49a498ae0eccc537df6f2663eabbb58cb2bfd52f1503b

  • SHA512

    df8caf3e379c4507efef928031ccf1e94bbd75ddf1e1f1e7d9e86dadfd6a6e15cbaf59f0c5847a69ef2a8a32ed5b58a9d5b01668aaf899889c1fd6b10041e7bd

  • SSDEEP

    49152:4jIb6b6i9KvgjHGk/QyGi7MldPqbe53I1f995hp2K0E:4jIb6b6i9KvgjGk/MXFcV952K0E

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2