Extracted

• • Target

    bd38a29392c4855ef21bf29ef385f1d6ee899366b1264c8c39b169370b3ab94a

  • Size

    1.7MB

  • MD5

    5083671493e1ba0ffc4c93caa2a6fced

  • SHA1

    00f847346e937d5c3bc1e2a92ec6d49ae415d684

  • SHA256

    bd38a29392c4855ef21bf29ef385f1d6ee899366b1264c8c39b169370b3ab94a

  • SHA512

    852bd9fa84cf220aac6619e5b0078be073b1cecefa939f1e3c6fae7cff4b767e013540b40d05e587b4708f983fd69e023b127d41587a9784e039dfe8ebb463e1

  • SSDEEP

    49152:W+967s4qTW5QZgDU//99RyYLmA52hl6Wgf0NNZS:WS67TqTW5QZ2Un99wYLmAa+f

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2