Extracted

• • Target

    a8bb33f2e7863a4f50af391645b42e1c401d58b91c017104215d222eef02ad70

  • Size

    5.0MB

  • MD5

    17d940e3012d0a3589f9dcb08cb8aacb

  • SHA1

    c173fb724ed8484c8e369fa75fe55c583652ca0b

  • SHA256

    a8bb33f2e7863a4f50af391645b42e1c401d58b91c017104215d222eef02ad70

  • SHA512

    a3fd59b9b53b966401ba000a1fbe8eef6c964420bbc123bb32b525e8c5d34199f217c62e28c14a8a1b981688fc88dcf4c13cf03ee2e02da7aa5dfaeface93569

  • SSDEEP

    98304:wYP8Zc0iQNurF33SihYA66Y2hiUgRR3qTWWSgjE:wYP8Zc0iQNurF3Iyg+W

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2