Extracted

• • Target

    b3dfb40fa19b4a19759bd60766049c27161b4223ea06380e15be7b0f057cb5bb

  • Size

    5.0MB

  • MD5

    8c40bb6c3c0e8a36f2eae8a4c847bb88

  • SHA1

    540209d851c92683c093101dd2bf73b0f4c63373

  • SHA256

    b3dfb40fa19b4a19759bd60766049c27161b4223ea06380e15be7b0f057cb5bb

  • SHA512

    3a2ef6aa88c5f57d4540ba218d3e30ebfad8d413aae09b79fc69c75f860664a7cce4c046ebac8cd662472801ca2b1300c5f3004670b671261d125b2d502f4d93

  • SSDEEP

    49152:/U5J1Yunor5IBvWZp0s+VRIwM5amXsno+ZrhH4jibjC:/U5w+oryBeZp0s+VRIwM4LoSp4ijC

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2