Extracted

• • Target

    ad3b0cdf3edd2264fc40e1470537c7a6255077c7f2f0611cede7b66fb92e23ccN.exe

  • Size

    1.7MB

  • MD5

    dab07ff32fc73f8c6baf669590650bc0

  • SHA1

    41ef8db60d427ad89ea1399454ffc968562e6204

  • SHA256

    ad3b0cdf3edd2264fc40e1470537c7a6255077c7f2f0611cede7b66fb92e23cc

  • SHA512

    26718e7ae690c0c403c7dda62676fc89c4c714c3b1fb2fdc71f1b272500ebb27e6f468b1a27c9d8131cb25742594a1f682bf86e231f08f927f2da601f5317cb2

  • SSDEEP

    24576:T9qIX5BrT6joVQjxCt7GzRiigfJI2hz+exIs7mm331/0+WeQbePXljEKmdocwCtq:0IjSmMf2JIy+vbmV/8bePVjEKm75

  Score

  10^/10

  stealcbratdiscoveryevasionstealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2