Extracted

• • Target

    ab01285ddc93dc762aba3a1330473a84f132733432438baa21f2b26cefe275ee

  • Size

    1.8MB

  • MD5

    7c3e03e3adfa97817e1b184b4bdfe68e

  • SHA1

    ddbac3163d9aad2a4f4313cab1e3d5e93afe2458

  • SHA256

    ab01285ddc93dc762aba3a1330473a84f132733432438baa21f2b26cefe275ee

  • SHA512

    efc853f2524e2a4604411d8ae08ccf1f03e42e17537d8ef17f881954d192f6a6e806ea5cf145bb33b62c29d71a0043a70dd2076eb3a3b98c82cb49f9ae518c9b

  • SSDEEP

    49152:r162nbpm0VEjrZ6LuAMOF/L8XKy2TdjSrKl14L1J:h62nb00Vgl6LuAMOh5y2ZjVl1U1

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2