Extracted

• • Target

    603708e817135fa0ce96a6ace60c74b4df878025463e8cfc5dc46bce63c9cdcf

  • Size

    5.1MB

  • MD5

    498f021ea83eb0e1327463f1909cf549

  • SHA1

    36c21d120d0d74a231c443cd607c7698341bd4c2

  • SHA256

    603708e817135fa0ce96a6ace60c74b4df878025463e8cfc5dc46bce63c9cdcf

  • SHA512

    eedfc2ea6e1fa0e571f33bcf911a227ec2a91d4812facbc67ec4976bf93f73ca2f9438d66362e4656958b1647aba8bd4c97f3ded9b2381ef85817d1cea321889

  • SSDEEP

    49152:9H0WruJYB6ooPBCLg1SqLl+nr8zvdqB6BSlsdQDO8:9H0WrmI6FP4Lg4Cl+nr8Ja6olWQC8

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2