Extracted

• • Target

    88d0907e14aee76cdac846db8243f3461b06ec8769eda047497191d02e7bf887

  • Size

    1.7MB

  • MD5

    bab9f5144b403a4ee4c4341878bba825

  • SHA1

    d909a2a0a5a2f46bd23a0dfb053d513f08453dd1

  • SHA256

    88d0907e14aee76cdac846db8243f3461b06ec8769eda047497191d02e7bf887

  • SHA512

    54a0c368f533cb8fe38063a187ce0f4ac68cde5f7c259b7c756cc09095537c2d70b5d6365481d7db38d45a377c6abfd36a3fa7376bf9a5616dc96777af5b5d14

  • SSDEEP

    24576:K+hr2AdAED9xMjtQwyuhSeOHJUS8lJpzVZa/4j10IFSh/ORTmjmSFvLrIJ12owdi:KudcjtOlgJhVXAUW4cowLO

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2