Extracted

• • Target

    38520f832e97b80b58ae27bde2455a33195605049c4923e6b531cd95f087d222

  • Size

    2.8MB

  • MD5

    ccd3d88f028bbaa1f9dde5ef92b59dc3

  • SHA1

    04b65468a65d99f003599e6dac235e386770438b

  • SHA256

    38520f832e97b80b58ae27bde2455a33195605049c4923e6b531cd95f087d222

  • SHA512

    9f9494cdf7428892e5c9d0a0090c02a157d8f8ec96c92fb0936c4db2967fd593023c7a204a7165b0c9ea4fd46f48bb8bfb397bbbc9d3e5886dcdb171cd527e32

  • SSDEEP

    49152:9SzhYgT8JC0LJRqNPgPgLl8ndh2/q7yQrm/:9SzhYgAJC0LJcNP4elGdnr

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2