Extracted

• • Target

    9dec0dc2187f00a04677d49d7da3ad45be58142f62e68e3195192465797e9506

  • Size

    2.7MB

  • MD5

    31c6811614e6b7a92d67610651f5a98a

  • SHA1

    77ef9f47c7f5898e8a9726425c9052fff2305b19

  • SHA256

    9dec0dc2187f00a04677d49d7da3ad45be58142f62e68e3195192465797e9506

  • SHA512

    107ab76eebf4c3fa9608786a0545f88e6c4ba083b0869a2e4cd76eb3161530beef228a4c0788ffcc6b77f852442c256908cdf5fc52aa464c2a22ba7bc558338d

  • SSDEEP

    49152:7waI9SBXtQBz02lS3FarZpeB9CrF/SpqO:7waI9SB9Az02lS1QpS9CrF/6qO

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2