Extracted

• • Target

    f9d42426976b8a1e404b713b0617e031602c7e0e1ad37e4815c407358f9bb951

  • Size

    1.7MB

  • MD5

    e1d8b18576d532f367b4cc5dfcfe56eb

  • SHA1

    908aa18a894891cb709e2603a97a3687018e973e

  • SHA256

    f9d42426976b8a1e404b713b0617e031602c7e0e1ad37e4815c407358f9bb951

  • SHA512

    c00e9ff4be4bb6a38cb53ff7689d3c9d16b7225c94fd4cc07f84b550aa965fcf4a571022902830c8623436f8b41cc642161ea79fbf132dae1ccf4ae0c8ddac10

  • SSDEEP

    49152:WhNZ1UXIZO/HftPDUpCtLFE88zMZujVnGJ4L:htLhLFENzM4jNGJ4L

  Score

  10^/10

  stealcbratdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2