Extracted

• • Target

    ba4c35b5bece7a43ae6b3b7de69717c859000ae10e68053db254d4b652167266

  • Size

    1.7MB

  • MD5

    7502d87b858048de6f2f2e0656a58896

  • SHA1

    d5f7a61a88b5e13fd46490d100f5ab53687523f5

  • SHA256

    ba4c35b5bece7a43ae6b3b7de69717c859000ae10e68053db254d4b652167266

  • SHA512

    abb9696b01cb137d49897026077ffab6f0506ebeebd4f7a3ec79b5a8eb588aa653dffa00eb78a7f4304d5f0e32406abaea44fd456438937f212e3d7cc64e42e7

  • SSDEEP

    49152:e2hsW7GcW7tj1qyK8oUimHFnpKG9LnMrHKbKIh:ecsnBpi8oUVHtbMrXIh

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2