Extracted

• • Target

    cb0ed9b54a262f1bedbcccc6eeae7c112429950126b6d395d7ea76b1ac760bc1

  • Size

    2.8MB

  • MD5

    763a2ab81b06ab00e728071e686bec77

  • SHA1

    2eb038527e6486ad4a1c440fa970ee85e821c51b

  • SHA256

    cb0ed9b54a262f1bedbcccc6eeae7c112429950126b6d395d7ea76b1ac760bc1

  • SHA512

    6d1e645c4f417a418b63003e9f0c1a205738f88fa7188665b5d44b2384e45a54f5690faff5f4749c9d93b1e50def92d276c59b21d955372c2fca60a804b57cc3

  • SSDEEP

    49152:It1GsqsfC90uwxI5NEwmfD8PNVNQLUvYM9ggVo:It1GsqsfC90xI5NEwmfD8lsoHmN

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2