Extracted

• • Target

    af67abc887e14a941251f6ce5990e953a32b9612edf68dea9e662b4ac883b97c

  • Size

    1.8MB

  • MD5

    db87494c774d26801e470e070372e4d7

  • SHA1

    55bbb939e20afb21cdf80116213640f6309bff9f

  • SHA256

    af67abc887e14a941251f6ce5990e953a32b9612edf68dea9e662b4ac883b97c

  • SHA512

    234f1fdfe4a79d2092f49ccb61d9abb81be6c906f6ee27deb543efb7e563af765975f35384ccc745833df815220aeace0847a96550f7b86db4d933d937f2b7b9

  • SSDEEP

    49152:SVbg+QYpeOCYD2gSQNXPOh+gFXqY2XZY/kVZ+QI9:+g+QYQOCYD2yxOh+gF6n37fI9

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2