Extracted

• • Target

    94801efab05e51fbd82cec7ea6f1eb216cc83fa9548222d4031880e3b71bd434

  • Size

    1.7MB

  • MD5

    3529de18a7cfbf22934e8e5649191f0a

  • SHA1

    8e68e2a7c6d9d3bcd73ed770b7d3feea218a7ac4

  • SHA256

    94801efab05e51fbd82cec7ea6f1eb216cc83fa9548222d4031880e3b71bd434

  • SHA512

    dc8ed4173ce5581503757e6771f88ec4192494eea789edb291e5d63aab245d521fb1998529b8610c69738f40895a77589d07e9775a8709176789cd7a41916391

  • SSDEEP

    49152:7zvn17j4qD06OKaR+/huk58aelzeM0y0L51L:3N7WNauk5Z8z5Q5

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2