Extracted

• • Target

    f13895a9f499d1c2783747f6f5c96ac690ff2423b1496cc86b6912c67a7cafd9

  • Size

    1.7MB

  • MD5

    07f4024a9ce4fa36d2ee6907ec0e827c

  • SHA1

    772203f6cbf91f48e318d2b398b61e88b81a75c0

  • SHA256

    f13895a9f499d1c2783747f6f5c96ac690ff2423b1496cc86b6912c67a7cafd9

  • SHA512

    82e863a69f59c94137a43c2584f6b800430e0264fd293a05ab43eca4cdabc5b8ad29464dd5ca93282ff25cd17c90ee6188c63f2e9f378b72426970713d5f97c4

  • SSDEEP

    24576:ryEq0KD5TRjAY46tFYBmY8GrqA1095RbqNlf9PdnDy60AwVzRoSh5FmBzE1rr6lg:lKD5TKwtF9A1095RGl7zwPcBwWl0Uye

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2