Extracted

• • Target

    c010f7da1401935d30e6448b48eac6bdae60ab5244d45c8fd8671ea914c4480c.exe

  • Size

    2.8MB

  • MD5

    d28368624064897b6de18c67ac34136e

  • SHA1

    53180c3e966601ceed981a57325c7ca951dcc118

  • SHA256

    c010f7da1401935d30e6448b48eac6bdae60ab5244d45c8fd8671ea914c4480c

  • SHA512

    8e2f50cd98b8ef9fd3c29aaefc10ba5ac9919d40d9dd21a186cf505fb7b1ab89a9e35bb2d9f2685a7bb5b88e66aebe831fcaff2ec1ccfe41e9baca46d5e3ccb1

  • SSDEEP

    49152:YO4KgbNIC8phsfIkCCA4JlAxbX41M9nY+IWwE5x/c/YwU/D:OKgbNIC8phsfJCCPlAO0fwEbEg5r

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2