Extracted

• • Target

    53d2f46e542782a650bca90703983ef0b71a49034730cf81af40cc01c596da4d

  • Size

    1.7MB

  • MD5

    7c01300fd39cefb3a23d9dea48a66573

  • SHA1

    0bd8b0d286577cb61863f6b8401ae2b3c374338a

  • SHA256

    53d2f46e542782a650bca90703983ef0b71a49034730cf81af40cc01c596da4d

  • SHA512

    55959728004930a83529f8c948890dec9d44a2cdd953159980d720af590812c93fe5defc026712f941a9d798abfbe9160bc7f81fc88d4f12169b53db33d1aceb

  • SSDEEP

    24576:czxrvMYxzZjxeWOUO2lmizixwbWSUKwdRAYmZoauXA6FqjKCrwLCZsYBI9X2J:czBjJn6wmi88UKgx6oJRqbZXBINa

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2