Extracted

• • Target

    b1c5cff848bcd495de524d2047c66a0cd6fa37c7a0301981255da30a5496673b

  • Size

    4.9MB

  • MD5

    09802b796640116d80c79a5f6072ba00

  • SHA1

    f1da66411b6a003b2b0fd4dc31483de8c8c9413f

  • SHA256

    b1c5cff848bcd495de524d2047c66a0cd6fa37c7a0301981255da30a5496673b

  • SHA512

    149b70e49ec0a7cff8b9fc3e2d37ed1a7f96172747b5a157b55cd3a885364f310f33e913ca96e0f5484ec99008574e2f93ad561e986c70452ce478ae17aa5c40

  • SSDEEP

    49152:bHl+/IzmuxULCxAS8DOZ/USNmzdojXWRJ1HEs:bHl+Azm8ULCx98DOZ/hAdoTK7HEs

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2