Extracted

• • Target

    a0aac9a98da66e68dcedd48ad1d9d657c6e4107ea409745fdfa1cf4eacff9697

  • Size

    4.9MB

  • MD5

    41e972777ac93aeb1727ff9cefea7fd6

  • SHA1

    d4540eaab8030fdf99844bed4437769e12a89269

  • SHA256

    a0aac9a98da66e68dcedd48ad1d9d657c6e4107ea409745fdfa1cf4eacff9697

  • SHA512

    e6c262d7268c8743ad1cdd0c59e53c83854079b4019f901ac972a1531e4f78d3c897d464218655243ac15091a9e2ab320d392f0e1eef362fdc50d3dd4f24b662

  • SSDEEP

    98304:Ig7HKSxSmAxaoG2Oc0vV69FkKYdPr7vD:P7H8q317D

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2