Extracted

• • Target

    e8adfe14ec237290bd1d09c67cccc82ddeab1709adf23fff0f65033c645e48d8

  • Size

    1.7MB

  • MD5

    65676205165c0beac882ab611131a395

  • SHA1

    986b422b50dbd4edc00ae218b975d26f81f48963

  • SHA256

    e8adfe14ec237290bd1d09c67cccc82ddeab1709adf23fff0f65033c645e48d8

  • SHA512

    49a57d53466de1ede5e19294134c6112a2617d3759120523fe48771f20e79f2eec0a92c81426bcc4146535f4fd03b8f8ae400151ac21fb5ea59e71f3b0847b15

  • SSDEEP

    49152:AbwhOpn+NsUPONs0x6vmm3zT0f2km+zjzYgZfiE3NuMr:XheUsUPONsfuMT0uofiE3NX

  Score

  10^/10

  stealckiradefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2