Extracted

• • Target

    cc0846676c706a78a002a457b2f1926d96a8efce254862938dff6fd8d9b10d76

  • Size

    4.9MB

  • MD5

    eb16b4307c051d1288357655e6f7e665

  • SHA1

    55fd9106f4e33875676aa76684ebe3bbef862c77

  • SHA256

    cc0846676c706a78a002a457b2f1926d96a8efce254862938dff6fd8d9b10d76

  • SHA512

    abe940ba4fc01a115b50367ee3542a2322e12fb3c6ef6305857e32e3a1a32a57fadd0c0973e5d3a942e4e6d4224293acd93b182b907e0a045fc1b4ca08f40e9b

  • SSDEEP

    49152:snVpVt1VkxoXiQyTwFFnJnuFGf52tzYwozgfNP1Q:sVpr1VkxAXyTWFxeGh2miPS

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2