Extracted

• • Target

    1c5ef711f1627f5d24c27c67995235c9a1477e1907f8142b88acbd7bce728456N.exe

  • Size

    1.7MB

  • MD5

    78f93fd2c3ac6e822275d54d0d9c7730

  • SHA1

    42db228f3b3d545a944913ea6d9bb83f16e932ee

  • SHA256

    1c5ef711f1627f5d24c27c67995235c9a1477e1907f8142b88acbd7bce728456

  • SHA512

    0ba4c16e926cea7945053bee23bad6cea317735c8281cd3d8b79d73a58838e4977feaaba3543f2cc24f0ba88587852f88c5f1fea04a8736e1d6d81fc76fcdc0e

  • SSDEEP

    49152:nJx1j9RIu7DBd9i3eoiTReDkzj0z8JDwNPpcuy:nJz9RB3R1TRtzj0tPp

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2