Extracted

• • Target

    12155b640cfbf5e91481bec6837cc532227488a45625dee25db74a2d8d4e33c8.exe

  • Size

    1.7MB

  • MD5

    f27e8de2c223f4f3a65897edb02b418d

  • SHA1

    fba65a32b91e645dd9ceec6de97e27de427c3e9d

  • SHA256

    12155b640cfbf5e91481bec6837cc532227488a45625dee25db74a2d8d4e33c8

  • SHA512

    48c899bc0eb401cabf669feb857d1f45862a9b66de9b7f55374d8f6dbf16eec85d069dd060ce3af3643a3d914fed577c5878037a9379f1a6e9573e0ef84366f8

  • SSDEEP

    49152:mvizimrTm2jViFazo587i6d1J7oOL/IR:mvizDNZBoud11o6g

  Score

  10^/10

  stealckiradefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2