Extracted

• • Target

    7cd1fe3752969067aaf59e54b7350e6db6218fef6410e3083cdbc6050cbce095

  • Size

    1.7MB

  • MD5

    c0a4fb0adfad5a941e25e52a4f70e935

  • SHA1

    8f8e88886f16454857d0e0402820828586395711

  • SHA256

    7cd1fe3752969067aaf59e54b7350e6db6218fef6410e3083cdbc6050cbce095

  • SHA512

    ce29adae2d3985c3ae6dca30c3e9384caee4998ea1bae455c6c2c60e2ed944e2631bb5dd170432977d1efb80dc8bfba88efd5e8d7aec71d61023a8edc6fa6a13

  • SSDEEP

    49152:s4/SmcEkRnVSM1R/0UaaK1GGqwcDa6aWZ68x6iN2F:siSpriM1R8JBTplQD

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2