Extracted

• • Target

    d7c71985ced8018382c0542b534cde02440dd26c86a7d8ce3e3036f2c5a80315

  • Size

    1.7MB

  • MD5

    60646f17e9f6b049da72655d24fe89ce

  • SHA1

    1e986ea72f157ae44a0df4ac68f7ecba41a87595

  • SHA256

    d7c71985ced8018382c0542b534cde02440dd26c86a7d8ce3e3036f2c5a80315

  • SHA512

    876ac4274502bee0765fd20d601239fc5e2f1f4ee4edab45e6d5c2779e2a3e69f960dcf29d7e13bca615286b0a63d8e0f11cc6cfbb5fb868bb560b0b5f408bed

  • SSDEEP

    24576:VoVa8OG96WIoLZRkz8uDwpnXxgMTOOuKzm+ByXAEeoqOn1lbDR04UhoLs4gjD+Up:Vqjy8Gwv/UWm+sQEg88iIDR

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2