Extracted

• • Target

    5b059307b89a21578aaee753740529e36dc3cbb175a1023480b3d727a7168269

  • Size

    2.1MB

  • MD5

    5d051404a364e24ecbaf02fddc51f234

  • SHA1

    0541737e338a50d1f36fe1c8d476d5c7aea726b0

  • SHA256

    5b059307b89a21578aaee753740529e36dc3cbb175a1023480b3d727a7168269

  • SHA512

    3fbd3c30dc97ce8e34df7ab7bb1e88463a27d7ba089e3a9fae9402f76e51c60d64e6c51d7636c277de3487f510c8f04cef4a1fb5b75aade8f132a9d1b0317d50

  • SSDEEP

    49152:N6uDuaS9refuoJtTF+TxMoxc1TU+j+dAzGwlrh:N6uKb97otIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2