Extracted

• • Target

    9ec54f886c3e4776af4553ac665cd5ec8fd790b4970f962487c11ecfa53ba2de

  • Size

    1.7MB

  • MD5

    ca2c3b369a889c70e87f9dfad6a67023

  • SHA1

    0a2f0e7f37004c863efe5c4f8caf19f0b51151b1

  • SHA256

    9ec54f886c3e4776af4553ac665cd5ec8fd790b4970f962487c11ecfa53ba2de

  • SHA512

    40deb70b0483a62b5d079b09cd8c087bf210aeb41be51b91262f8dae574bb850c6033b59b833eef9663120a326fbe24652a23718c4cd90cbaf356fe8d1594bd8

  • SSDEEP

    24576:R68FEyWvxF7H1AY5UzKSoYYCvinc1V3vrug4Z+RxZ/iVo0RRslPTsqhsLxh:RFEyYFpLSKSsCSof6gyghqoIRQnsL

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2