Extracted

• • Target

    bb69d5db2aaa93e9a224a0393489f33642004712331153f25df8e01b5bd23b9a

  • Size

    1.7MB

  • MD5

    c990229b34f3b2eee58af2be505866fc

  • SHA1

    573b222bddb7bce861b0e3eff9405a5017418a72

  • SHA256

    bb69d5db2aaa93e9a224a0393489f33642004712331153f25df8e01b5bd23b9a

  • SHA512

    f17c98123fda0ce5839c54ae9355fdd8931a3084acf6c0238b9b918bf670df6c19f246bd6c59e81c5d75368507ca3db7d6658f424c27a5bc1ab2e9b476509352

  • SSDEEP

    49152:v6PQ+uWl+n01VWvlNW9ekXVgKJrzyTZwHdpes0:iTuWs01VQl8R6+v

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2