Extracted

• • Target

    5cdd3f667134ad3cda79c81353c37860885bf84c7419da1e9aeb14993850a1a2

  • Size

    1.7MB

  • MD5

    c3b99e00883a10bfd3b0d0c0776f65f7

  • SHA1

    a51dcd3f1869aab5cb247267ffe258789a58a6a3

  • SHA256

    5cdd3f667134ad3cda79c81353c37860885bf84c7419da1e9aeb14993850a1a2

  • SHA512

    5e3a6ab133d4e876b27b3532945804b039511005248cdea9b1b31ac2d83aba654198ee1cfe05613fc63892ba0719f98fb36bffd0d3576ff8f374ddd6b87670ed

  • SSDEEP

    24576:0JZuYcUmAT5YtZ8qaKPRHD/Z8lbK7TGBNnMj5Yo8QB+ItX0lQbHRX5SZWuwz:0JZuckXjobvznMV+Ql0mbHOZWh

  Score

  10^/10

  stealcbratdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2