Extracted

• • Target

    9175feef2943b05dc196eca70af03b87b5a00af8bd0f88b87929561c68663344

  • Size

    2.7MB

  • MD5

    332a4162dbeaa01b903e2cfb935c981e

  • SHA1

    3af6fd07c1873fc064d2df8c432ac6c1d8751f6d

  • SHA256

    9175feef2943b05dc196eca70af03b87b5a00af8bd0f88b87929561c68663344

  • SHA512

    2454a1b88b7e66f0407a9a9781ea7a104325efc51cedebf1508c2e2b06438be5c37cc12c4692109d676428f9887768e17a14dfeccacad646827f9649a22ca3e4

  • SSDEEP

    49152:kODta1az5/eiQxcu6HQvA4Mfgv+JrQCx2xgOY0OU:bg1az5/eiQxyHQI42gv+J4x5Y0O

  Score

  10^/10

  stealcstokdiscoveryevasionstealercredential_accessspyware

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2