Extracted

• • Target

    4010c0dfdeacd10bca240b254393c1db8d542dd2dc1a3d2c1b1c964b9262f932

  • Size

    1.7MB

  • MD5

    c30a7e97333b6994435f4b1d46b4d1b6

  • SHA1

    73f2547cd05dfc135d35b34e70a90fb5b3e7a0dc

  • SHA256

    4010c0dfdeacd10bca240b254393c1db8d542dd2dc1a3d2c1b1c964b9262f932

  • SHA512

    4fa4b9c65c1dfad95691f62dcf8fb02e792c1a4ca340a955fa6a7bd663aed9b2207b96527dbb22534cac55787447c6df147b9e4029ea0929ebafb27cc819d6a3

  • SSDEEP

    49152:HoxXDafSv5EcyLoFTD0+yff4ww5sUnHddi2:HcXDafUPyWofHO5T9R

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2