Extracted

• • Target

    d5293d112971e79081529465c284e0e642f082d768f5107a7d5706b51fdbe2f1

  • Size

    1.7MB

  • MD5

    fab79f8cbb940bd1ddab6357715336c4

  • SHA1

    b7c89e0d6e2f5c094558ca4748b72aff1ed1f3c3

  • SHA256

    d5293d112971e79081529465c284e0e642f082d768f5107a7d5706b51fdbe2f1

  • SHA512

    d239e94ec9107b71e22a8951e230a704cb6306246c1566c39d9beadbf98a95e82092dbea79c915f3b2e114c0358d84c0379cba18eac774ead76d0d75187b7f3b

  • SSDEEP

    49152:UzSmELXwfhM8PLsvSTHWLnxio6tuRGaJ:U+mELXyMIlT2X6YR

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2