Extracted

• • Target

    TradingView_Premium_(password_github)/TradingView Premium.exe

  • Size

    780.4MB

  • MD5

    03c012cc3f4802d728841a93f3603278

  • SHA1

    e72bf615b2a48a8325c0beb49a4a68c639d0f83f

  • SHA256

    33e9d22f4fa05763400a8adb6ce954e21a09209ae366f85f3c4dde035e57f9ee

  • SHA512

    198d0cd063317242c8ce522b1a523823f641f0f9012b7e4e66e909b3fe5a38cdf7b431576c26e64035dae470c2a4bc4f41dd18950a78d6ee749d1559472dc0aa

  • SSDEEP

    98304:pt5Nn3KaFYG6BCuacrYflgURaSgaWmxE9bxNkkbzAQi/ybzCLpRZL:pJ60YG3uaaYtgwaDmx1kbz5zYL

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2