Extracted

• • Target

    242a2af95649b17491512cc47738db2daabccd346bed01f888a87d7f65cb6d5d

  • Size

    1.7MB

  • MD5

    9c4a91d095e3ce7b507136bf2cb399df

  • SHA1

    f250236a6c348999443d7460578ee055d837182f

  • SHA256

    242a2af95649b17491512cc47738db2daabccd346bed01f888a87d7f65cb6d5d

  • SHA512

    84371b2fbe80991126c5ada3dba3ebb590b72ce98b4abd24b88d57a901073e5d1420608783cda9739b69d6dcf2fc50687d73292f6da2d4e6f077ac617bd4807d

  • SSDEEP

    24576:k3Jad98zXRyHMt/qO6VFAvl8cGzlvE4o9nau2BpW7kioOyMgQgzRla2uVRTHWkGU:kzzRmAvpG42G7kisQgvduvTHlLd3

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2