Extracted

• • Target

    6f6fd4d2fc13cac3f98777556e3b67c6110c57b424fb2fba2adab3d02c310bff

  • Size

    4.9MB

  • MD5

    e37e670d977ba920bc799ac6f7ce593c

  • SHA1

    01bcfbcadbf5719a89e31f0ff19f706fdddc354d

  • SHA256

    6f6fd4d2fc13cac3f98777556e3b67c6110c57b424fb2fba2adab3d02c310bff

  • SHA512

    489fd761b4d2e223606a192ec3a9eebb19ca7b2fbe7504b9e41fc0ce2f409d50ac6d61608654b8c9e4fbdd4d26460b980d5ffda16c80f2c17d96b3c046f26bfd

  • SSDEEP

    49152:cJ5VdusKdXxiTZqqJ0BSrXsR836ZLxjeWk9Q8YZA/:cJ57fMXxiTgq6BLO6Zxjxksq/

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2