Extracted

• • Target

    f6284bf206a074e322c8b7a8211bbc9312ef82e5f8de021f5efeee1bf825fa7a

  • Size

    1.7MB

  • MD5

    cadd3d3e9618bb546c3e23b5bd7c9f97

  • SHA1

    8a99a2cdd18bf517f719c981b89d70b65cfb6650

  • SHA256

    f6284bf206a074e322c8b7a8211bbc9312ef82e5f8de021f5efeee1bf825fa7a

  • SHA512

    10c26e018db102358bbbad09faefc7c358092eded59bb88887896519e7cb4bc5ca94af86f62b407f2532443f454bec46d4d1ecb66d57dfbda7719b52d5818eed

  • SSDEEP

    24576:EM7fgaiZEy2LhRnw4Q/SJV/vkP+gDg8fklKWzK7S2GUC9SHicUPWIrgeA/OvvKzI:gTZARnw4foGr47VGN8HZU5gu3aQj

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2