Extracted

• • Target

    2f7c8b63603fe0ed3f601d761273c942ee7f653d99e877de523f510a00d2a519

  • Size

    4.9MB

  • MD5

    60f731b97a2421dea30691441f641be7

  • SHA1

    aae49838c624586bdc28c6f53aa3a65c6299ec98

  • SHA256

    2f7c8b63603fe0ed3f601d761273c942ee7f653d99e877de523f510a00d2a519

  • SHA512

    ada50d8202770752edf857c8957618cc8780a9682f19e67c498dad10c1729a3794c641ec806688ae1225ef70760e0b1f11cbbc7bfe39ee1e40b8130a5b325342

  • SSDEEP

    49152:FQf/3MlgjnOsvSxsNVY7kMowHpAijto6gLayJuWIIygG:G3ManOsvSSNVY7kgJRtQRVv

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2