Extracted

• • Target

    581beb90d3a95664ad5324ed52b99c37b22d68615f5395fb2aaec375bb11ffef

  • Size

    2.1MB

  • MD5

    f2959059828270ba768b14e728326811

  • SHA1

    e30d676fe5b2526ee5bb757cdd6f280447014c0e

  • SHA256

    581beb90d3a95664ad5324ed52b99c37b22d68615f5395fb2aaec375bb11ffef

  • SHA512

    3367a54c018c22e2a62e6cd80dd0e1ad4d7997b9e44cd92504e0fdc4a1f0c4f5fab583525e2697f508d3ec6f3b69946ac2e6e02eb858f93fe23036352758c071

  • SSDEEP

    49152:N6uDuaS9ref+AJtTF+TxMoxc1TU+j+dAzGwlrh:N6uKb97AtIuoITsdZ

  Score

  10^/10

  stealcvidardiscoveryspywarestealer

  • Detect Vidar Stealer

    stealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2