Extracted

• • Target

    aa97ab933ea20860f8fbddc2f18ba1d28031498b185147d71f18bb68c649baee

  • Size

    5.0MB

  • MD5

    464c49f07bc577dcb3aea7428c6ec9f8

  • SHA1

    53fe9ff9e7d75c3ad142ab0acb3b1cb5e04dd19c

  • SHA256

    aa97ab933ea20860f8fbddc2f18ba1d28031498b185147d71f18bb68c649baee

  • SHA512

    c902501a9c9f2ad6f8a952bede844462145cbc41cd55e963d1244fe40c1584838608218023ddd11ebd96a3dada452ef73346beafef7a0acdbc73dbf5b544e8dd

  • SSDEEP

    24576:SwkHo0+IDRs75ToxmN9n7qdwLct0vtJ32lWhIVxA/SxuOsUQEmjAIaeNNrI08YvX:VOIbnu22ktkl1vAq4jBvSKEBUxVTO

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2