Extracted

• • Target

    6ec802a2b25753c36b3c840b7a6839da64ce66744102c124d9c482ec8ef30d88

  • Size

    1.7MB

  • MD5

    d844a577074ebb26b23e941d1de86dab

  • SHA1

    78e22e8bb0370aaccaf82555ef6e1fd2022e205b

  • SHA256

    6ec802a2b25753c36b3c840b7a6839da64ce66744102c124d9c482ec8ef30d88

  • SHA512

    ddca787396b66dd665a421eed1748d585dcbdb5e4f3e0e02c6f9f3cdfcf8a593b35cd6494f5ec159245fecf7232bb4511fb104dc7b442c1b8ea5dbbfae3add32

  • SSDEEP

    49152:02OFh1znfLvcTnQQYbS92INvELfFPfJmxQOk:02gznjvc8ZS8ccZkq

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2