Extracted

• • Target

    047faf10f893cd97e831f436351a0dda5816093537f8a1cddd9a3e3334fea4a8

  • Size

    5.0MB

  • MD5

    1451b57ba4eb5f5e50379fb8e3ef21c4

  • SHA1

    438b6c57df4c4e04f986c73bf752978d49df9d0d

  • SHA256

    047faf10f893cd97e831f436351a0dda5816093537f8a1cddd9a3e3334fea4a8

  • SHA512

    a84d04261973956b64b8bfae376f46491fcf1ad4fd8a9681bed53be7e40f5f2f577f52cd7ffb93a31a62d35c89db2b9c529e482ad7407554d869943665647afd

  • SSDEEP

    49152:a4ebbdus0UWct6hW8hk0O2WgOm3dtDTYXPvduHVWbdt:a4cdus0UWct6hW8hnO2W+ddTYfvd4oH

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2