Extracted

• • Target

    bea98a74c6bbce2b3b934a2c0ffb593db0b63f190d9b69e99b23a25ca693e94d

  • Size

    2.7MB

  • MD5

    7ebc22fc52d7d3cc7e66f1a5e92a3a96

  • SHA1

    4b1d0403b39e9f8c5a8c69174a018f228c4b82b4

  • SHA256

    bea98a74c6bbce2b3b934a2c0ffb593db0b63f190d9b69e99b23a25ca693e94d

  • SHA512

    5a63b28f7c81959828055f2f35ff7f7b68681439db9c7d01f5b1c7f8d60d57d576e2c804fae0f5bf341b878b944bb2f8c2df1c295d85a55e5f3c8913111eb2e7

  • SSDEEP

    24576:NViMG9aahpsQzSw25h34adfB4vVDBCyJ2HbDT9fIoBNVTAPQB8GnhRhzEDc40hYN:+MqaiDjEJfFVlfhiifHufhjgD

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2