Extracted

• • Target

    c171e4bf720c8cc23e9207dddabc6ae252202058fabfa16d58eae379c519be2f

  • Size

    1.8MB

  • MD5

    8b5cbf86ba3b3e4ae03dbca3d8df6bef

  • SHA1

    0555fa21f04dc96ae5e515031afb488e0ef96256

  • SHA256

    c171e4bf720c8cc23e9207dddabc6ae252202058fabfa16d58eae379c519be2f

  • SHA512

    88e04761bc06c81a0bc8dc8c58d7fd6d15bd4e14f93981eae263404c45f56e3528bb2bdb3ffe6000e1b69a2c48255a2996b233f0831c4dd2701fc01fa7455e5b

  • SSDEEP

    24576:reynnqjIeoWPbQm8CK0zJtHn/vqqA8cjb9DXNQ0qecnjSz29Fud7/e1sDK58xjAm:regKx5T9XTnHn/R2P9DdQQeB1sDKk

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2