Extracted

• • Target

    084dd0f273398d8c6558dec0c8ab58f48c1655e91a1526cdba23e925c1e38b0e

  • Size

    1.7MB

  • MD5

    a5c8e1cb34e0966e67658d1a5dcbf151

  • SHA1

    4ad23a922c4e68f9031064d25291797ab0cc6130

  • SHA256

    084dd0f273398d8c6558dec0c8ab58f48c1655e91a1526cdba23e925c1e38b0e

  • SHA512

    8fed13a4eb1039486e88c8d5c9413d1f9ce0a0c4d0540610346e3894adda822d0cc88568ab9e1286d7d25ea710273318e1b5d3d3f476c1123963985ecee0b7ce

  • SSDEEP

    49152:nj+ZGhHNbp/nZhU8SdpB/Ka4aRm/xXYJFGdbO07GqP3e:KgZv/ZhAdphKa46KxXuwdZN3e

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2