Extracted

• • Target

    a7fe0330982a0ec1d976412ce3c5101a3ab687ba4f48e80ee5f5498ea2e83f69

  • Size

    1.7MB

  • MD5

    0b11da9f066fe2274bb6279b16d670bf

  • SHA1

    2a767706454bf4770c369233415a8285864c400d

  • SHA256

    a7fe0330982a0ec1d976412ce3c5101a3ab687ba4f48e80ee5f5498ea2e83f69

  • SHA512

    fcd421e8c944219d05791c945eca8f5ebde003f12360ad8cb3f0bbe200a586f380725076925833e2b90201c069cae400898818fc2c3f620d60e3dd234a36ef55

  • SSDEEP

    24576:xR47FurepwKAICFXbtQ0+MuJvl6YiFJ7gxo87uEJ0HL1PNEZFTEayWra2l7O0J2p:xWErGdIn+MiC37nEc11+pVWI7RSBPB

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2