Extracted

• • Target

    82d0862036be8bc99c66cf47fe2ce566.exe

  • Size

    1.7MB

  • MD5

    82d0862036be8bc99c66cf47fe2ce566

  • SHA1

    4780977be2d9f5e314fc26aa4259e3103027549b

  • SHA256

    c945fec1f4b68201a33eb8b1cefd8ca7f18cd41a51ab5367d0c7ec711576a2fb

  • SHA512

    27cfa837b184d4d943e8f06ec433c3d1a2e3677c1c77a864886669a8790adc1f6c752c72e9ae6fac2eedfbf39d671791f669bc1853074cc3329aad9b3655d738

  • SSDEEP

    24576:y7VLdyi3dlbraD2psJ9L841IFrfW+tFSKFKIvMwPtEkW8QzWg3mB5p97Tx:y2QuDK4uFrrVF7PtE5pWymBz97Tx

  Score

  10^/10

  stealcrenodefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2