Extracted

• • Target

    e65319903b70ae142a07b8bf5f4573ac65b428e26cd93cbf2380e5e00f4efc0d

  • Size

    2.7MB

  • MD5

    59729e914fa8e15d347129643c03ac1f

  • SHA1

    80acb4be6a6534fb8de67caafee13a03d9e15754

  • SHA256

    e65319903b70ae142a07b8bf5f4573ac65b428e26cd93cbf2380e5e00f4efc0d

  • SHA512

    b592b27b3db5b041d1d45b206239ffd4b37c051aeb6ea0e74e57623920e15cb18f12696e596eaeb5788d57629917f9d8324c588ef8a62d6f470173795ca79b36

  • SSDEEP

    49152:kSmc33xGO68K1vu9T+TS6fZ0pZxvPFfJi+1hSdY:kRqhG5P1vu9T+m6fZ2xvNj1hSdY

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2