Extracted

• • Target

    be8a46a2048e3b38f35321b3ef05690a15153b452ca5cc9f7963c8cd1d1dfe2b

  • Size

    1.7MB

  • MD5

    592a90554eee35da6011c62fa4872062

  • SHA1

    feb4ac8ddf58e5459d79610aea5db438dd9bc454

  • SHA256

    be8a46a2048e3b38f35321b3ef05690a15153b452ca5cc9f7963c8cd1d1dfe2b

  • SHA512

    3ffb2f7bd5a429e88b43f189dff148e84d30c7bf0e4f439eff0619cd4c33fd78e52609e436c05d00988b0eb5aa403938a603012964548e43e2cff6673b03b9bb

  • SSDEEP

    49152:Fe7qaHI5h3kG6VsDkn0N2hGmjAUWd2tKTRLcUUkhFG:kWawCQ40UGuAUWd2tKTDxrG

  Score

  10^/10

  stealcstokdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2