Extracted

• • Target

    04bce38ba335bde88809ba5fe04305e33fcd5e7c0977b1ec12a1d1861f12b922

  • Size

    4.9MB

  • MD5

    3ed9ed7eab5e48b5f2e341c59a2a31d8

  • SHA1

    038d40dc46a92b479d032cf0b347f188e271a876

  • SHA256

    04bce38ba335bde88809ba5fe04305e33fcd5e7c0977b1ec12a1d1861f12b922

  • SHA512

    de7ff374e21b48cfa5f11bc465ab52725b944a25a36d778cd03d490220695092bbac5ed13521e1f48ada6519bccd9c52695a09c1890f0ed10c2008f7aefb17fb

  • SSDEEP

    49152:PykEezi9S4fb/nWws9tXVKHS1Jv+TVHd0qbJFR/W6Bzm8:PRJzio4fSws9tXbLG5Hi6I8

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2