Extracted

• • Target

    990c9975ecdf091324c7d3f6f272ddec10ed1eb6fa72e00d27028576985e036c

  • Size

    1.7MB

  • MD5

    d86c1eb28ee301715af07d167663b79f

  • SHA1

    eb7790f06c77fa2977e13b769ab12653e5bd8ec9

  • SHA256

    990c9975ecdf091324c7d3f6f272ddec10ed1eb6fa72e00d27028576985e036c

  • SHA512

    1921bbf61f7d7e9da42160b7316fc644896cd032746ba2004e5757c79861eb527fd68b00ecaebd157d8954b325f6ea73a5f579a37961d90f73b45e535f57979c

  • SSDEEP

    49152:o3WH/F/dU4Ho8PP3rGMnDuxJulGwcbrjtn7R2:JN/Dv33rGDxJuMtrjW

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2