Extracted

• • Target

    56998c972948a8dc69e388158cdb4ad9fc38fbc05538e91295a130a34cfe69ca

  • Size

    2.8MB

  • MD5

    b25f2117faddee0012b548e795fa75de

  • SHA1

    735cab6e4cf78ed64e1609e9ba06ed0d919afdc4

  • SHA256

    56998c972948a8dc69e388158cdb4ad9fc38fbc05538e91295a130a34cfe69ca

  • SHA512

    30e86652a3c4b4219887d1cec08406389f71992623e06de1a1e498468ef3552a2dd258c1e4e17eaba7b0672b16c6a48aec9e0835ac6b53d8651277950aa619a7

  • SSDEEP

    49152:ayU3j44ia9HP01DR0hhL5U+aBCQgQrrJM485HF:ZU3U/QHP01DR0hXbaBCQgQfJMD

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2