Extracted

• • Target

    234280ffc991114a1b74687cdf084ba754d826a3f6026aee65c3f21c21d57cf1

  • Size

    1.7MB

  • MD5

    b2b25c53809cd8a4d1ad9a4c66dac6cb

  • SHA1

    e1f1d1c7bb790d4d7f43b1ad320815bc3db47286

  • SHA256

    234280ffc991114a1b74687cdf084ba754d826a3f6026aee65c3f21c21d57cf1

  • SHA512

    160f940f14ee5e37d82d4bc308ef659d1be333e04a819580049ccebbeec3dee402af489570a74aeabb6c30342f0bfadf24b738df10f3edc7ba10770d4f59d4fc

  • SSDEEP

    24576:bYhZe1B6+8Q+XSTR9TDQJ29C7C3Sgzbi8ZMSesantnNHUWwdgDiQ8825XdvyvjGQ:uy98Q+Cl9TDpPPq8ZkJxqq38FwjW/eQ

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2