Extracted

• • Target

    cb3d56ebb17f2a8101c3c0c8e49f97da0dd2e57047a47d3a5469759824d573d1

  • Size

    1.7MB

  • MD5

    1e2cd841291b37908bb8f53ac3b9ee54

  • SHA1

    dc08f9ab49a294d55aa22b86406f24f8a4f06ee9

  • SHA256

    cb3d56ebb17f2a8101c3c0c8e49f97da0dd2e57047a47d3a5469759824d573d1

  • SHA512

    3264cf6a973b89a23b0755ba7a5fe49819d5acd59c2d908c6135f0142c9f985b4825b8e7e81d0f09d14faa05f57af2daa6ffc0ba372aaacc6c8b8f7adae28c94

  • SSDEEP

    49152:ANEUnvh+177lpgB49uzP1hIDuDwbM26E4:4ng17hHZDH4z

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2