Extracted

• • Target

    a3f4b5c2cf7f1a01cafdb03c4866ba7b83c54a9dfb8fd0cca161cf610630c2bc

  • Size

    1.7MB

  • MD5

    b98080a07b23b0f8c4dcdc78c48d4e1c

  • SHA1

    a46090f11b3b83194f48e37216c98e708f5a65f6

  • SHA256

    a3f4b5c2cf7f1a01cafdb03c4866ba7b83c54a9dfb8fd0cca161cf610630c2bc

  • SHA512

    9c37f5f3d086253041d47fa7db13828b35c7217c1cb4290aaebfe6d150743efa9c0c2be7b7f5a59f9b473f7b3ff5e4de458c5bfa340590ce5b47832af6289dbc

  • SSDEEP

    49152:FBJ7d9Q30oyboen7/pKfUPjAMfongB0z+WVNzV:XOI0Y7xwUPjAMwMADjzV

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2