Extracted

• • Target

    41b6fe4dff0b7fb397e32081f05a91e614bfdfb6494979187c45117de54ce69f

  • Size

    1.7MB

  • MD5

    ccdc5c7a275be78442c6f1d906637ada

  • SHA1

    211def83f0925bfef34769abf4ad5afad9bf4884

  • SHA256

    41b6fe4dff0b7fb397e32081f05a91e614bfdfb6494979187c45117de54ce69f

  • SHA512

    9d3cab961de7ca6309d1b5161005ed6cb08799679c050e02dd99e1f3316caea84e69c578704eee3099f51911fc35251e06cfa7dd1cbee728cc13628f97fb725b

  • SSDEEP

    24576:14z7JlNQufMoW3oLGW5KjIsulDPgukhj/2DJ10NGjXwJIXWSzm3Lah9OvwdvERXT:1Y9XVz5KIAVSyGrqIXXm3Lp/RXrT

  Score

  10^/10

  stealcrenodefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2