Extracted

• • Target

    0412585671517c0505b9d15dc3bc007944fc1303342553d0b1d35ab586a99709

  • Size

    1.7MB

  • MD5

    2253fe8a45eeeb110df97f22b414c678

  • SHA1

    1aeb545fce680e0cc8879729963dece7be2528ed

  • SHA256

    0412585671517c0505b9d15dc3bc007944fc1303342553d0b1d35ab586a99709

  • SHA512

    1e3d91f240747c92887d3122adcb232ac4493700ab666c0f0ac446090a1fddd4028cda79956bd6bae1c2d36ebb952c894a7255a4ebee4e9d4b3ff8d0d1258fce

  • SSDEEP

    24576:bdcoRsJQmZCcOAAKrHL7FY2uzaWHCPByHhhgQpFNL+jcKYO70MsPfdsXqhFan:bdsOmZCarHkdZ1pFNlO70MQdsaf

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2