Extracted

• • Target

    b44255c5f4ee75738a2d023a3d28e4ba739428da9c54bf32b4060ee0bc54ec2bN.exe

  • Size

    1.7MB

  • MD5

    2dfb8158238eaea77e018d655ddb93f0

  • SHA1

    63ed6e5e5837c8eb8ec81ae7facefcc086d55b48

  • SHA256

    b44255c5f4ee75738a2d023a3d28e4ba739428da9c54bf32b4060ee0bc54ec2b

  • SHA512

    5cf7c8ed3d5f5108172e8cdabd1940b2282d92cb5c05f748f251b332bcd26ba55fb747c8874715230d605ad77b5e1077371d5ee0a9e09e61f4aebabcbc0b550d

  • SSDEEP

    49152:lT4NrRZIzAF6ld8hpXIXwpeqpm0xq2guKeoM/:NUrAkF6lGnX+AHxqPe

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2