Extracted

• • Target

    d0aed8c3505d5d132a268ed834e997ccf1460b44a5ad1ba3e2ea8f774c2869d7.exe

  • Size

    1.7MB

  • MD5

    b451adb762630b12baa85fa85a15c464

  • SHA1

    c1db90b0cfcc96d7b5279868e8359953b73230b6

  • SHA256

    d0aed8c3505d5d132a268ed834e997ccf1460b44a5ad1ba3e2ea8f774c2869d7

  • SHA512

    3242412937042167a7af961eb7e6870f4265310c2bb49fcc990b67971c015940a650425a6a47613c0dcb5d56e9735717d3a452df638c44bd58b8e19e620c886a

  • SSDEEP

    24576:T9qIX5BrT6joVQjxCt7GzRiigfJI2hz+exIs7mm331/0+WeQbePXljEKmdocwCti:0IjSmMf2JIy+vbmV/8bePVjEKm75o

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2