Extracted

• • Target

    3acd04016a0846f4e6c69d4684ac0a21dc476e63f8e7957fc73ca58c90f40857

  • Size

    2.8MB

  • MD5

    880f67c30d6c2335273b27df0004f500

  • SHA1

    d340d73b98a457d26180d69c28486f4d0cb98432

  • SHA256

    3acd04016a0846f4e6c69d4684ac0a21dc476e63f8e7957fc73ca58c90f40857

  • SHA512

    346c038aa380b6467417d01d9fae63bb55424886c85ac42cf98e2c9fe851c55c31bc4b46096cc793233409366c9752325c20c8ff5150eaeb8184b54ec7878ccc

  • SSDEEP

    49152:sClAvSx/8MLHGbScHSJtB9YfkahghnWxS30m:sClaSx/8Mb8SQpk0gv0m

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2