Extracted

• • Target

    6444a93b36a157483348af81c8e1f6ba5b07fc18066da778911b67cf03fe76f7

  • Size

    1.7MB

  • MD5

    ead09a627546993696917dcc306f94dd

  • SHA1

    e38409912bf89fd7ee9333c09ba3a0f7182330de

  • SHA256

    6444a93b36a157483348af81c8e1f6ba5b07fc18066da778911b67cf03fe76f7

  • SHA512

    f79caec3477b12d50b32763fede06f6fd009ba167d983ce9910eac4a3169fc6bb75fcca557e9ff257bb82a25c9210c01fcb353292b67475a8b8e9ab998dc7ddb

  • SSDEEP

    24576:1m5ueNxX6u71S8MFT0FR29BY5C5c2F4ZCllm2Nco1OqRiIeqKjkiiH4IP:ktRxSXm0Bbu2FLLOqPKl44

  Score

  10^/10

  stealcbratdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2