Extracted

• • Target

    7bd38004d31037e2310abca4378bdc296a0a35bd3a5b4cc892d44bdbf5a89779

  • Size

    2.8MB

  • MD5

    6ad8c80adf22544fa38534491968ee1f

  • SHA1

    10630c3020fcafd52ea2d67385fdee4278a65121

  • SHA256

    7bd38004d31037e2310abca4378bdc296a0a35bd3a5b4cc892d44bdbf5a89779

  • SHA512

    ad73321f2698d344832e991310d3c3e6f8ea494094c81f949b229f6e76b0a259dc364d958afd2562f5d2b0166cc0795ce297af20e072e46899a66a1332787a65

  • SSDEEP

    49152:DOUWOwj+j90BI2+UVCKQz4WHvCRqHcmttDQ:DOnOug90BI2+UkKQzJOq8mTs

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2