Extracted

• • Target

    823b1e28ec41e073557d3b5d5c19183c8041bb307ed75a6398ff9ab9f29354d4.exe

  • Size

    1.7MB

  • MD5

    c6ae9bc2dc6cc21141d3d2c5d91a90cc

  • SHA1

    007ed00300003fb5a06b6ec75801a05e258517dc

  • SHA256

    823b1e28ec41e073557d3b5d5c19183c8041bb307ed75a6398ff9ab9f29354d4

  • SHA512

    4810333278122ab515a5ff422258f718cb1e72e63e168c4659bef6fb1baa11be8b874aa42f1974542048dbd9dbf9b20c9661d34ded1700d694afc0ad1d740759

  • SSDEEP

    49152:RmE/8ijfKdw3Fz2+pkhJXbZIkHnYTC0dQJBBsBx:R1kijT3F5yXbikH8Q/m

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2